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October 2005 


The Honourable Daniel Hays, Senator 
The Speaker 
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Dear Mr. Speaker: 
I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 


Electronic Documents Act for the period from January 1 to December 31, 2004. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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The Speaker 
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Dear Mr. Speaker: 


I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 
Electronic Documents Act for the period from January 1 to December 31, 2004. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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Foreword  ————is™ 


he year 2004 saw the Personal Information Protection and Electronic Documents 

Act (PIPEDA) reach maturity, with the Act extending across the country to all 

commercial activities, except in provinces with legislation deemed substantially 
similar. British Columbia, Alberta and Quebec have enacted private sector privacy 
legislation that has been deemed substantially similar to PIPEDA. PIPEDA applies 
to federal works, undertakings and businesses across the country, as well as to 
interprovincial and international transactions. 


The maturing of PIPEDA is cause for some celebration. Canadians now have 
comprehensive rights relating to personal information in the private sector in Canada, 
in addition to longstanding protections in the public sector through the Privacy Act 
and its provincial equivalent legislation. That is not to say that either the private 
sector or public sector privacy laws fully protect the privacy rights of Canadians in 
every sense. They do not. But much of the essential framework for protecting those 
rights is now in place. Our Office will continue to enforce and analyze the application 
of PIPEDA to ensure that Canadians are well-served by it, and that the Canadian 
private sector understands and respects its obligations under the Act. We will continue 
to help the business community comply with it, and develop the best practices which 
will minimize burden and clarify expectations. 


Interjurisdictional challenges 

As with any relatively new legislation, problems can emerge. Where a province has 
enacted legislation that is substantially similar to all or part of PIPEDA, confusion 
may arise about which law — provincial or federal — will apply to certain information- 
handling practices. In other cases, the laws of two jurisdictions may be involved in 
addressing an issue. Some elements of the handling of personal information may 
be subject to a provincial law — the collection of the information within a province, 
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for example — while another element, such as the transborder disclosure of the 
information, may fall under PIPEDA. 


However, the dust is beginning to settle around these jurisdictional issues due to 
concerted efforts by our Office, our provincial counterparts and industry. We are 
working with our provincial colleagues to streamline investigations where provincial 
and federal jurisdictions both apply. It is not our intention to make life difficult for 
those who must comply with the various privacy laws in Canada, and we clearly do 
not want to waste the limited resources available to privacy commissioners across 
Canada by duplicating efforts in conducting investigations and developing policy. 


A complex and changing universe 

There are many powerful forces in the universe in which we assert our privacy rights — 
galloping advances in surveillance and data-handling technologies, global competition 
in business which drives companies to obtain and use more personal information 
about customers and personnel, and the government imperative to acquire personal 
information to enhance administrative efficiency and respond to the security concerns 
of our world. Those of us attempting to protect this fundamental right must call 
out strongly for a debate that can be at times unpopular and demands a wealth of 
expertise in ever more complex fields of research. It is a challenge to keep up. 


It is important to remember that information is power, and holding the personal 
information of individuals conveys power to the holder. One complexity that we have 
been grappling with this year stems from a convergence of two phenomena which are 
not new by any means, but which have reached a critical point. “Outsourcing” of data 
processing operations and call centres results in the personal information of Canadian 
residents or customers of Canadian companies being transferred and processed outside 
Canada. The thirst of foreign governments, particularly that of the United States and 
its allies in the war on terror, for access to personal information for “security” purposes 
means that the outsourced data may be accessed for law enforcement or national 


security purposes, outside our jurisdiction and the protection of our laws and our 
Court system. 


Transborder data flow has been discussed in Canada since the 1960s. The original 
report on Privacy and Computers, published in 1972 by the Departments of 
Communications and Justice, dealt with the matter extensively, including matters 
of sovereignty. The issue prompted the Organization for Economic Cooperation 
and Development (OECD) to meet and develop the first Guidelines Governing the 
Protection of Privacy and Transborder Flows of Personal Data in 1980, and it drove 
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the European Union to pass its Directive 95/46/EC on the protection of individuals 
with regard to the processing of personal data and on the free movement of such data. 
Yet we know very little about the details of transborder flows of personal information 
about Canadian residents and customers. 


The current interest in the USA PATRIOT Act has raised an issue that has been lurking 
beneath the surface for decades — the extent to which Canadian businesses, and 
governments in Canada, should share personal information with foreign governments. 
The discussion is far from over. In fact, it is just beginning. Our Office endorsed 
many of the recommendations of the B.C. Information and Privacy Commissioner, 
David Loukidelis, on issues of transborder flows of personal information and we will 
continue working to ensure Canadians’ privacy protections remain in place. 


This Office is tasked with protecting privacy in Canada. We cannot do the job alone, 
we depend on all players in society to contribute to preserving the freedoms and rights 
which are an intrinsic part of Canada’s rich fabric and history. The complexity of the 
current privacy environment has led our Office to launch a Contributions Program 
to help develop a national privacy research capacity in Canada. The findings of this 
first round of research projects will be available in 2005. These research findings will 
complement the existing policy research function within our Office, and in a modest 
way help to enrich the community of privacy scholarship in Canada. 


Responding to a greater need 

This Office received 723 complaints under PIPEDA between January 1 and December 
31, 2004, more than double the 302 received in the previous calendar year. We closed 
379 complaints, significantly more than the 278 cases closed in 2003. While the 
debate about the merits of having the Commissioner continue to operate as an 
ombudsman versus giving the Commissioner order-making powers remains, it is clear 
that our Office has accomplished much that is positive using the current ombudsman 
approach. Some 40 per cent of the complaints closed during the year were settled, and 
another seven per cent resolved — an indication that suasion, a prominent feature of 
the ombudsman approach, is an effective tool. 


We have introduced a formal procedure of systematic follow-ups to complaint 
investigations under PIPEDA. We will now be in position to monitor the progress 
of organizations in implementing commitments they make during complaint 
investigations and in response to the recommendations our Office issues to them. 
Equally important, our Audit and Review Branch is strengthening its capacity to 
audit organizations subject to PIPEDA. 
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We faced many challenges in 2004, challenges that will only increase in frequency 
and complexity. This is not a time for those concerned about this fundamental human 
right called privacy to shrink from speaking out, from debate or from controversy. We 
will seize the opportunity of the 2006 review of PIPEDA to make recommendations 
about how to improve and better enforce the two pieces of legislation that we oversee, 
Although the Act is still very new in application, the dynamic environment of 
information policy demands that we keep current and try to ensure that the legislation 
also responds effectively to current threats. We are developing a list of improvements 
and suggestions for change, and we are confident that in another five years, when the 
next review is due, there will be more changes necessary. Parliament was wise to insist 
on periodic review of this legislation, and we will continue to push for review of the 
Privacy Act and inclusion of such a review mechanism in it. 
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fe te ee ee a ele i Se NS ge 


This year, we have published two separate reports, dividing the Privacy Act from the 
Personal Information Protection and Electronic Documents Act (PIPEDA). We felt this 
was more appropriate given that the Privacy Act requires us to report on the fiscal year 
(2004-2005), while under PIPEDA we are required to report on the calendar year (2004). 
As well, each Act provides a separate framework for investigations and audits. Both our 
reports detail efforts we have taken to meet the growing demands on our Office to act as the 
guardians of privacy for Canadians on behalf of Parliament. There 1s much overlapping 
between these reports because many of our activities are not particular to one law or another 
and, increasingly, the policy issues are common across the two regimes. 
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Our Multi-Faceted Mandate —s_—s™ 


he Office of the Privacy Commissioner oversees two laws — the Privacy Act, which 
applies to federal government institutions, and PIPEDA, which governs personal 
information management in commercial activities. 


Parliament requires our Office to ensure that both the federal public sector and 
private sector (in most provinces) are held accountable for their personal information 
handling, and that the public is informed about privacy rights. The mandate is not 
always well understood. 


As an independent ombudsman, we are: 


* An investigator and auditor with full powers to investigate and initiate 
complaints, conduct audits and verify compliance under both Acts; 


° A public educator and advocate with a responsibility both to sensitize businesses 
about their obligations under PIPEDA and to help the public better understand 
their data protection rights; 


° A researcher and expert adviser on privacy issues to Parliament, government 
and businesses; and 


- An advocate for privacy principles involved in litigating the application and 
interpretation of the two privacy laws. We also analyze the legal and policy 
implications of bills and government proposals. 
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Policy Perspective  =s_— 


n 2004, our major preoccupations in the policy area were the heightened demands 

for personal information in the name of national security, the transborder flow of 

personal information, and that hardy perennial, privacy invasive technologies. From 
cell phones in locker rooms to global positioning systems in cars, the need to measure 
the impact of these new technologies and read the privacy law into their design and 
application is an ongoing challenge. 


Technology 


During the past year, the privacy implications of using Radio Frequency Identification 
Devices (RFIDs) as tracking devices have become increasingly prominent. RFIDs 
encompass technologies that use radio waves to read a serial number stored on a 
microchip. The microchip or tag can be placed in military equipment, passports, 
clothing, currency notes, vehicles, tires, pass cards and just about anything else sold 
in the marketplace, including food and drink packages. RFID applications include 
tracking goods from the manufacturer to the retail store, tracking people in a health 
institution or monitoring the movements of schoolchildren. 


Depending on its individual design, an RFID can transmit information over long 
distances or only a few centimeters. It may hold no personal information or store 
extensive personal information, including biometrics. An RFID can be “active” or 
“passive” — active where it has its own power to broadcast information to a reader, or 
passive in that it lies dormant until awakened by a signal from a “reader.” 


The combination of tags, (sometimes smaller than a grain of rice or built invisibly 
into the paper of a product), powerful coding and advanced computer systems has 
created enormous economic incentives for companies to introduce RFID technology. 
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A recent market forecast predicts that the global value of the total RFID tag market 
will expand from $1.95 billion in 2005 to $26.9 billion in 2015. Given that each 
RFID tag may eventually cost only pennies, the potential scale of use is greater than 
almost any other single technology. 


Organizations must think carefully about the legal implications of deploying RFID 
systems. Amidst the flurry of activity involving RFIDs, very few people fully understand 
the myriad of privacy implications. We are now encountering many marketplace uses 
of RFIDs, and expect that we will soon be investigating complaints about tracking 


the use of RFIDs. 


Similarly, although there have been some interesting stories in the press about the use 
and abuse of global positioning technology, most individuals are unaware of the data 
that is accumulated by such devices. Fortunately, PIPEDA contains an innovative 
provision requiring openness with respect to information practices. 


Organizations placing global positioning devices in consumer goods or conveyances 
(rental cars, for example) must identify what the device does, the data it collects, how 
long the data is kept, and who has access to it. 


We are entering a world where computing power will be present in the most ordinary 
day-to-day devices. If we are not careful, that power will be used to gather or broadcast 
personal information in ways that greatly diminish our privacy, not to mention our 
autonomy and human dignity. As transmitting devices are built into roadsides, licence 
plates, currency and books, we are hard pressed to keep up with the potential privacy 
invasions and abuses. Canadians need to become more aware of and participate in 
discussing the privacy issues that flow from these developments. We need to shape 
our future into something that reflects the rights and freedoms we cherish today. From 
Reginald Fessenden to Marshall McLuhan, Canadians have shown leadership in the 
development of communications technologies and in communications theory. We are 
confident we can now rise to the current challenge, and demonstrate how we can use 
these powerful devices, in the world of ubiquitous computing and communications, 
yet maintain respect for that most fundamental of human values, privacy. 


Parliament’s Window on Privacy 


The Privacy Commissioner of Canada is an Agent of Parliament who reports directly 
to the Senate and the House of Commons. As such, the OPC acts as Parliament’s 
window on privacy issues. Through the Commissioner, Assistant Commissioners and 
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other senior OPC staff, the Office brings to the attention of Parliamentarians issues 
that have an impact on the privacy rights of Canadians. The OPC does this by tabling 
Annual Reports to Parliament, by appearing before Committees of the Senate and the 
House of Commons to comment on the privacy implications of proposed legislation 
and government initiatives, and by identifying and analyzing issues that we believe 
should be brought to Parliament’s attention. 


The Office also assists Parliament in becoming better informed about privacy, acting 
as a resource or centre of expertise on privacy issues. This includes responding to a 
significant number of inquiries and letters from Senators and Members of Parliament. 


> Appearances before Parliamentary Committees 


Appearances before committees of the Senate and the House of Commons constitute 
a key element of our work as Parliament’s window on privacy issues. During the 
period covered by this report, the Privacy Commissioner and other senior OPC staff 
appeared nine times before Parliamentary committees: six times on bills with privacy 
implications and three times on matters relating to the management and operations 


of the Office. 
The OPC appeared on the following bills before Parliamentary committees in 2004: 


e Bill C-6, the Assisted Human Reproduction Act (March 3, 2004) 

e Bill C-7, the Public Safety Act, 2002 (March 18, 2004) 

e Bill C-2, An Act to Amend the Radiocommunication Act (May 6, 2004) 

e Bill C-12, the Quarantine Act (November 18, 2004) 

e Bill C-22, An Act to establish the Department of Social Development and to 
amend and repeal certain related Acts (December 9, 2004) 

e Bill C-23, An Act to establish the Department of Human Resources and Skills 
Development and to amend and repeal certain related Acts (December 9, 
2004) 

e Bill C-11, the Public Servants Disclosure Protection Act (December 14, 
2004) 


Regarding the management and operations of the Office, OPC officials appeared 
before Parliamentary committees on the following matters in 2004: 


e Annual Report and Main Estimates 2003-2004 (November 17, 2004) 
e Supplementary Estimates (December 1, 2004) 
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> Other Parliamentary Liaison Activities 


The OPC has undertaken a number of other initiatives over the course of the past 
year to improve its ability to advise Parliament on privacy matters. 


In May 2004, we created a dedicated Parliamentary liaison function within the Office 
to improve our relationship with Parliament. This function resides in the Research 
and Policy Branch, reflecting the OPC’s desire to focus its Parliamentary affairs 
activities on providing in-depth and accurate policy advice to Senators and Members 
of Parliament. 


Improving on how we assess, monitor and forecast Parliamentary activity has been a 
priority for us in the past year. The OPC put in place a new and improved system for 
monitoring the status of bills on Parliament Hill, as well as keeping tabs on new and 
emerging developments of interest to privacy promotion and protection. Our goal 
is to build bridges to departments so that we can comment earlier in the legislative 
process, when our criticisms could be dealt with more effectively. It is often too late 
when a bill has been introduced in the House of Commons, to rethink approaches to 
information issues. 


The Office has responded to a significant number of inquiries and letters from 
Senators and MPs this year, and the Commissioner and Assistant Commissioners 
have also met privately with Senators and MPs who wished to discuss policy matters 
relating to privacy, or wanted to know more about the operations of the Office. 


In late 2004, the OPC in conjunction with the Office of the Information Commissioner, 
and in collaboration with the Research Branch of the Library of Parliament, held an 
information session for Parliamentarians and their staff on the roles and mandates of 
both Offices. This information session was well attended and raised many questions 
among participants. We believe such information sessions contribute to increasing 
awareness of privacy issues on Parliament Hill, and look forward to holding more 
such sessions in the future. 


> Priorities for the Coming Year 


The Office expects to be busy in the area of Parliamentary affairs over the next 
fiscal year. ‘here are a number of bills of interest to us expected in the upcoming 
session, and the statutory review by Parliament of the Personal Information Protection 
and Electronic Documents Act is expected to start in 2006. The OPC plans to play a 
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constructive role during this review, by providing thoughtful advice to Parliamentarians 
mandated with studying at how the Act has worked over the course of its first years 
of implementation, and how it may be modified and improved. 


The OPC will continue to follow with interest the Parliamentary review of the Anti- 
terrorism Act. The Privacy Commissioner appeared twice before committee on this 
matter in fiscal year 2005-06—once before a Senate special committee reviewing the 
Act (May 9, 2005), and on another occasion before a sub-committee of the Commons 
Standing Committee on Justice (June 1, 2005). 


We recognize that to act as an effective Agent of Parliament we need to have good 
working relationships with federal departments and agencies. The OPC plans to 
put more emphasis on identifying and raising privacy concerns when government 
initiatives are being developed rather than waiting until they reach Parliament, as this 
increases the possibility that privacy concerns will be taken into account. 


National Security 


In May 2004, the Public Safety Act, 2002 was enacted. The Act, first introduced 
in November 2001 in the wake of the September 11 terrorist attacks, allows the 
Minister of Transport, the Commissioner of the RCMP and the Director of the 
Canadian Security Intelligence Service (CSIS), without a warrant, to compel air 
carriers and operators of aviation reservation systems to provide information about 
passengers. While this may seem reasonable given the risks that terrorists pose to air 
transport, authorities are not using this information exclusively for anti-terrorism and 
transportation safety. The Public Safety Act, 2002 also allows the information to be used 
to identify passengers for whom there are outstanding arrest warrants for a wide range 
of lesser criminal offences. In other words, the machinery of anti-terrorism is being 
used to meet the needs of ordinary law enforcement, lowering the legal standards that 
law enforcement authorities in a democratic society must normally meet. 


The retention and mining of private sector data collections by government sends 
a troubling signal to private sector organizations trying to comply with privacy 
legislation. If the government can use data to manage risks from unknown individuals, 
why can’t the private sector? Private sector companies are cutting down on data 
collection to comply with PIPEDA, but now the government is asking them to retain 
it so that they can access it for government purposes. PIPEDA sets a high bar for 
organizations with respect to using and disclosing personal information without 
consent for the purposes of investigating fraud and other illegal activities that have 
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an impact, while the standards that government must meet under the Privacy Act are 
much less rigorous. 


In 2004, our Office raised concerns about a provision in the Public Safety Act, 2002 
that amends PIPEDA. The amendment allows organizations subject to PIPEDA 
to collect personal information, without consent, for the purposes of disclosing 
this information to government, law enforcement and national security agencies if 
the information relates to national security, the defence of Canada or the conduct 
of international affairs. Allowing private sector organizations to collect personal 
information without consent in these circumstances effectively co-opts them into 
service for law enforcement activities. This dangerously blurs the line between the 
private sector and the state. We comment more extensively on public safety issues 
in the Privacy Act Annual Report, but this is also an important issue under PIPEDA 
because of the potential for inappropriate manipulation of private sector data to serve 
state interests. 


The 2001 Anti-zerrorism Act contained a provision requiring a review after three years. 
The Senate has appointed a special committee to conduct its review. The House of 
Commons review is being conducted by the Subcommittee on Public Safety and 
National Security, a subcommittee of the Standing Committee on Justice, Human 
Rights, Public Safety and Emergency Preparedness. However, the Commons 
Committee is not looking at the many other pieces of legislation that were also 
enacted or amended in the wake of the terrorist attacks. Many of these laws contain 
extensive powers to intrude and should be examined as well. 


The Official Secrets Act was replaced by the Security of Information Act in 2001. Section 
10 of the new Act allows the deputy head of a department, on the issuance of a 
certificate, to bind members of the private sector to secrecy for life with respect to 
methods of investigation or special operations. We understand that sometimes it is 
necessary to deal with threats to our national security and critical infrastructure, but 
we raise the warning flag when we see new powers without complementary oversight 
provisions to ensure accountability. We have raised the issue of accountability and 
oversight in our submission to Parliament on the review of the Anti-terrorism Act, but 
this particular provision is in the Security of Information Act, and we think it merits 
public reporting on how often it is being used. 


In the war on terror, governments have made it clear that they must have the 
cooperation of the private sector to ensure public safety and the security of the critical 
infrastructure. From the perspective of this Office, we must also ask whether we can 
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effectively oversee the private sector and the role it might play in security matters. In 
the United States, the use of private sector databases and information retention for 
law enforcement and anti-terrorism continue to attract criticism. We do not know the 
extent to which such use and retention occurs in Canada, but it is an issue of growing 
concern to Canadians and we are trying to get answers so that we can respond to their 
queries and complaints. 


In July 2004, Canada began enforcing new marine security requirements under the 
International Maritime Organization's International Ship and Port Facility Security 
(ISPS) Code. To further enhance port security, Transport Canada is proposing to 
introduce a controversial Marine Facilities Restricted Area Access Clearance Program 
to screen port workers who have access to restricted areas. This screening process will 
involve collecting significant amounts of personal and potentially sensitive information 
about as many as 30,000 port workers. Once again, the extent to which such security 
checks are dependent on private sector information databases is of interest to our 


Office. 


The issue of data-matching is an old one that has pre-occupied privacy scholars and 
oversight bodies for over twenty years. Technology has advanced, and we really no 
longer speak of data-matching but rather data-mining. There are many invisible uses of 
integrated information systems that collect and analyze significant amounts of personal 
information related to our travel patterns, our financial transactions, and even the 
people with whom we associate. Many of these systems would be viewed by consumers 
as immensely positive, were they to know of them and fully understand them because 
they provide faster loan approvals, instant recognition of credit card theft, and better 
customer service. However, these systems also now analyze deep reservoirs of personal 
information in an attempt to find patterns that might suggest that an individual is a 
security threat, a money launderer or is engaged in financing a terrorist group. 


As law enforcement and national security agencies collect more information from 
more sources about more individuals, the chances increase that decisions will be based 
on information of questionable accuracy, or that information will be taken out of 
context. 


When personal information is misused, misinterpreted or inappropriately disclosed 
it can have serious adverse consequences for individuals, families, and even 
communities. The problem is aggravated when, because of secrecy provisions and 
a lack of transparency, we cannot find out where the system broke down or on what 
basis individuals were wrongly targeted. 
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Outsourcing and Transborder Flows of Personal Information 


The transfer of personal information from Canada into foreign jurisdictions 
(transborder data flows) is another issue as old as privacy legislation itself. Scholars 
and government policy experts in the 1960s and 70s anticipated greater flows of 
data in the future as communications technology improved. Whether they could 
have predicted the enormity of the global flow of data that we see today is another 
question. 


In 2004, the transborder issue became more visible in Canada when a complaint was 
raised in British Columbia about the outsourcing of health information processing 
from the B.C. government to a U.S.-linked company operating in the province. The 
B.C. Government Employees Union alleged that the information would be available 
to the U.S. government under the expansive search powers introduced in 2001 by 
the USA PATRIOT Act. Although there have been many high profile instances of 
outsourcing in recent years, with occasional concern about the privacy implications, 
this appeared to be the first where a specific piece of legislation was singled out as a 
threat. The B.C. Information and Privacy Commissioner, David Loukidelis, took the 
step of issuing a call for public comment on this issue, and we submitted a brief in 
response. 


Our submission explained that a company holding personal information im Canada 
about Canadian residents was not required to provide the information to a foreign 
government or agency in response to a direct court order issued abroad. In fact, the 
organization in Canada would in many cases violate PIPEDA if it disclosed the 
information without the consent of the individuals to whom the information relates. 


However, there would be no violation of PIPEDA, for example, if the organization 
disclosed the information under Canadian legislation such as the Aeronautics Act 
provision that allows Canadian air carriers to disclose passenger information to 
foreign states. 


We also concluded that an organization operating in a foreign country and that 
holds personal information about Canadians in that country must comply with the 
laws of that country. This means that when a Canadian organization outsources the 
processing of personal information to a company in the United States or another 
country, that information may be accessible under the laws of those countries. 
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The foreign government could of course request the same information through a 
mutual legal assistance treaty (MLAT) and ask the federal Department of Justice 
to arrange for Canadian law enforcement agencies to obtain the information 
from corporations in Canada for them — a system of government-to-government 


cooperation that predates the USA PATRIOT Act. 


PIPEDA deals succinctly with transborder data flows in Principle 4.1.3 of the Schedule 
to the Act. This principle requires that information transferred for processing must 
be protected at a level “comparable” to that provided by PIPEDA. However, when 
data is held or processed outside Canada there is a loss of control over what a 
foreign jurisdiction might do with that information and our Office has no oversight 


authority. 


We urgently need to address these flows of personal information so that we can 
ensure protection of the personal information we send around the world. A series 
of news reports in early 2005 concerning security breaches by companies in other 
countries holding personal information about Canadians has further emphasized the 
importance of devoting attention to transborder flows of personal information. 
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Research into Emerging Privacy Issues — 


n June 1, 2004, our Office officially launched a Contributions Program to support 
(=== by not-for-profit groups, including education institutions, industry 
and trade associations, and consumer, voluntary and advocacy organizations, 
into the protection of personal information and the ways to protect it. The program 
represented a milestone in the development of national privacy research capacity in 
Canada. The program is designed to assist our Office to foster greater public awareness 


and understanding of privacy. 


The 2003-2004 Contributions Program had two key priorities. The first was to 
examine how and to what extent emerging technologies affect privacy. These 
included video surveillance, RFIDs, location technology and biometrics. Many of 
these technologies have their most profound impact on privacy when they are in the 
hands of government, but they often also have significant privacy implications when 
used by the private sector. 


The second priority of the research program related more directly to the implementation 
of PIPEDA, especially since new sectors of the economy became subject to the Act 
in January 2004. This part of the Contributions Program focused on awareness and 
promotion of good privacy practices as a key component of responsible commercial 
behaviour. 
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The projects that were funded for a total of $371,590 include: 


FUNDED PROJECTS _- 


Canadian Marketing Association Taking Privacy to the Next Level $50,000 
Toronto, Ontario Assess and develop privacy best practices to assist businesses in better 

handling customer personal information under PIPEDA 
Ecole nationale d’administration Study on the use of video surveillance cameras in Canada $50,000 
publique (ENAP) Perceptions, issues, privacy impact and best practices on the use of 
Quebec, Quebec video surveillance 
Queen's University Location Technologies: Mobility, Surveillance and Privacy $49,972 
Kingston, Ontario Trends and stated and implicit purposes of technology with workers, 


consumers, travelers and citizens 
The B.C. Freedom of Information and PIPEDA & \dentify Theft: Solutions for Protecting Canadians $49,775 


Privacy Association Gap analysis on weaknesses in personal information management 
Vancouver, British Columbia practices that lead to identity theft and policy recommendations for 
PIPEDA implementation : 
Universities of Alberta and Victoria Electronic Health Records and P/PEDA $49,600 
Edmonton, Alberta Implementation of PIPEDA in the health care sector and application 
Victoria, British Columbia to electronic health records in the primary care setting 
University of Toronto A review of Internet privacy statements and on-line $48,300 
Toronto, Ontario practices 


Evaluation of implementation of PIPEDA and privacy statements 
on the Internet by companies in the telecommunications, airline, 
banking and retail sectors 


University of Victoria Location-Based Services: An Analysis of es $27,390 
Victoria, British Columbia implications in the Canadian Context 


Privacy implications of geographic location-based services — issues 
raised and major challenges and guidance to encourage compliance 


Option Consommateurs The challenge of consumer identification with new $17,100 
Montreal, Quebec methods of electronic payment 


Current and new proposed methods of identification of consumers for 
electronic payment and risk factors 


Simon Fraser University Privacy Rights and Prepaid Communications Services: $14,850 
Vancouver, British Columbia Assessing the Anonymity Question 


Justification and feasibility of regulatory measures to eliminate the 
sale of anonymous prepaid communications services in Canada __ 


Dalhousie University An Analysis of Legal and Technological Privacy Implications $14,603 
Halifax, Nova Scotia of Radio Frequency Identification Technologies 

Study of RFID technology and privacy impact and legal measures to 

protect privacy 


The projects are to be completed in 2005. We will post links to the research results 
on our Web site. 
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Substantially Similar 
ProvincialLegislation 


ur Office is required by section 25(1) of PIPEDA to report annually to Parliament 
() on the extent to which the provinces have enacted legislation that is substantially 

similar to PIPEDA. 
Beginning on January 1, 2004, PIPEDA extended to all commercial activities. However, 
section 26(2)(b) allows the Governor in Council to issue an order exempting certain 
activities from the ambit of PIPEDA. This order can be issued if the province has 
passed legislation that is deemed substantially similar to PIPEDA. The order can 
exempt an organization, a class of organizations, an activity or a class of activities 
from the application of PIPEDA with respect to the collection, use or disclosure of 
personal information subject to that legislation that occurs within the province. 


The intent of this provision is to allow provinces and territories to regulate the 
personal information management practices of organizations within their borders 
while ensuring seamless and meaningful privacy protection throughout Canada. 


If the Governor in Council issues an Order declaring a provincial act to be substantially 
similar, the collection, use or disclosure of personal information by organizations 
subject to the provincial act will not be covered by PIPEDA. Interprovincial and 
international transactions will be subject to PIPEDA, and PIPEDA will continue to 
apply within a province to the activities of federal works, undertakings and businesses 
that are under federal jurisdiction, such as banks, airlines, and broadcasting and 
telecommunications companies. 
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Process for assessing provincial and territorial legislation 

On August 3, 2002, Industry Canada published a notice in the Canada Gazette Part 1 
setting out how it will determine whether provincial/territorial legislation is deemed 
substantially similar to PIPEDA. 


A province, territory or organization triggers the process by advising the Minister 
of Industry of legislation that they believe is substantially similar to PIPEDA. The 
Minister may also act on his or her own initiative and recommend to the Governor 
in Council that provincial or territorial legislation be found substantially similar. The 
notice states that the Minister will seek the Privacy Commissioner’s views and include 
those views in the submission to the Governor in Council. The public and interested 
parties will also have a chance to comment. 


According to the Canada Gazette notice, the Minister will expect substantially similar 
provincial or territorial legislation to: 


e Incorporate the ten principles found in Schedule 1 of PIPEDA; 

e Provide for an independent and effective oversight and redress mechanism, 
with powers to investigate; and 

e Restrict the collection, use and disclosure of personal information to purposes 
that are appropriate or legitimate. 


“Substantially similar” provincial legislation enacted to date 

Quebec's An Act Respecting the Protection of Personal Information in the Private Sector 
came into effect, with a few exceptions, on January 1, 1994. The legislation sets out 
detailed provisions that enlarge upon and give effect to the information privacy rights 
contained in Articles 35 to 41 of the Civil Code of Quebec. In November 2003, the 
Governor in Council issued an Order in Council (PC. 2003-1842, 19 November 
2003) exempting organizations in that province, to which the provincial legislation 
applies. PIPEDA continues to apply to federal works, undertakings or businesses and 
to interprovincial and international transactions. 


British Columbia and Alberta passed legislation in 2003 that applies to all organizations 
within the two provinces, except for (a) those covered by other provincial privacy 
legislation and (b) federal works, undertakings or businesses covered by PIPEDA. 
The two laws — both called the Personal Information Protection Act — came into force 
on January 1, 2004. 
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Using the criteria set out in the Canada Gazette notice — the presence of the ten 
principles found in Schedule 1 of PIPEDA, independent oversight and redress 
and a provision restricting collection, use and disclosure to legitimate purposes (a 
reasonable person test) — we concluded that the British Columbia and Alberta laws 
are substantially similar to PIPEDA. 


For Alberta and British Columbia, the Governor in Council issued two Orders in 
Council (P.C. 2004-1163, 12 October 2004 and P.C. 2004-1164, 12 October 2004) 
exempting organizations, to which the provincial legislation applies. PIPEDA 
continues to apply to federal works, undertakings or businesses and to interprovincial 
and international transactions.. 


Ontario's Personal Health Information Protection Act (PHIPA) came into force on 
November 1, 2004. PHIPA establishes rules for the collection, use and disclosure 
of personal health information by health information custodians in Ontario. Our 
Office has informed Industry Canada that we believe PHIPA as it relates to health 
information custodians to be substantially similar to PIPEDA. Industry Canada has 
requested comments on a proposed order declaring the Ontario law substantially 
similar to PIPEDA, but an Order in Council had not been issued when we prepared 
this Annual Report. 


Jurisdictional Issues 


For most of 2004 — beginning January 1 and ending October 12 — the Alberta and B.C. 
private sector privacy laws were in force, but had not yet been declared substantially 
similar to federal law. During this period, both the provincial private sector laws and 
PIPEDA applied. There was concurrent jurisdiction. 


In Ontario, PIPEDA applied to personal information in the private sector (except for 
provincially-regulated employees) beginning on January 1, 2004. Ontario’s Personal 
Health Information Protection Act, 2004 (PHIPA) came into force on November 1, 
2004. Since November 1, both PIPEDA and the Ontario legislation have applied to 
personal health information in the private sector. As was the case with the Alberta 
and B.C. private sector legislation until Ontario’s PHIPA is deemed substantially 
similar, both PIPEDA and PHIPA will apply to personal health information in the 


private sector. 


Even a “substantially similar” order may not be broad enough to eliminate concurrent 
jurisdiction completely. With Ontario, for example, the “substantially similar” order 
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will not apply to some entities regulated by Ontario’s PHIPA. The proposed order 
may apply in respect of the rules governing health information custodians; Ontario's 
PHIPA would therefore be the sole law applying to health information custodians’ 
collection, use, or disclosure of personal information in Ontario. 


But the substantially similar order would not apply to third parties who receive 
personal information from health information custodians. PHIPA imposes rules on 
non-health information custodians only about the use and disclosure of personal 
health information. PHIPA does not regulate other privacy obligations, such as 
collection, access and safeguards. Therefore, PIPEDA would continue to apply to 
these activities. 


One simple way to avoid the work of Commissioners overlapping in areas of concurrent 
jurisdiction is to reach informal agreements about who handles what. Our Office will 
work closely with Ontario, as it has with B.C. and Alberta, to ensure that both Acts 
are enforced in the most seamless way possible. 


Even where a “substantially similar” order exists, not all intraprovincial commercial 
activity will necessarily be covered by the order, and jurisdictional boundaries are 
not always clear. Complex jurisdictional issues may still arise and require close 
collaboration between jurisdictions to deal with them. 


For instance, Alberta’s Health Information Act (HIA) applies to health service providers 
who are paid under the Alberta Health Care Insurance Plan to provide health 
services. On this definition, HZ4 does not cover health practitioners, who provide 
health services privately. While Alberta’s Personal Information Protection Act (PIPA) 
does apply to private sector organizations, it does not apply to health information, 
as defined by HIA, which is collected, used or disclosed for health care purposes. 
Under this regime, the collection, use or disclosure of personal health information 
by practitioners working in private practice to provide health services seems to have 
fallen between the cracks; it is not currently covered by either Alberta Act. Hence, 
such activity is subject to the federal PIPEDA. 


As a postscript, a bill was introduced in the Legislative Assembly of Alberta in 
March 2005 to amend Alberta’s PIPA in favour of bringing the activities of private 
practitioners who collect, use or disclose personal health information in the course of 
providing health services clearly within the scope of PIPA. This amendment has since 
come into force and resolved this jurisdictional problem. 
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Flows of personal information across provincial boundaries . 

Another aspect of the jurisdictional issue arises with flows of information across 
provincial boundaries. An Alberta company may disclose personal information to 
another company in Saskatchewan in the course of a commercial activity. An individual 
could complain about this interprovincial transaction to our Office. Alternatively, an 
individual who wants to complain about the disclosure of personal information by the 
Alberta company could direct the complaint to the Alberta Information and Privacy 
Commissioner under Alberta’s PIPA. However, if the individual is complaining about 
the collection in Saskatchewan of their personal information, he or she may direct the 
complaint to the Privacy Commissioner of Canada, as Saskatchewan does not have 
substantially similar legislation in place governing its private sector organizations’ 
activities. Whether the complaint is initiated in Alberta, with our Office, or both, our 
respective offices will work together to coordinate our work where possible. 


Sometimes the jurisdictional issue is entangled. In one case handled by our Office, 
the complainant worked for an organization in one of the western provinces that has 
substantially similar legislation. The organization provides disability insurance. The 
individual applied to the insurance company, located in Quebec, for access to her files. 
Those files are kept in Toronto. The insurance company responded as if PIPEDA 
regulated the question. Is PIPEDA the appropriate legislation or does it fall to one of 
the provinces? 


In another case, an individual worked for a company in one of the western provinces 
with substantially similar legislation. Through the company, the individual had an 
employee assistance program (EAP) in Ontario, and complained about a disclosure by 
the EAP. Because Ontario does not yet have substantially similar legislation, PIPEDA 
would apply in Ontario. But is this an Ontario issue — because the EAP is located in 
Ontario — or is it within the jurisdiction of the western province under that province's 
private sector legislation? 


Streamlining our approach to jurisdictional issues 

Federal and provincial Commissioners are working together to resolve jurisdictional 
challenges. This process has been collegial, not confrontational. Some individuals may 
raise jurisdictional matters in the courts but these issues can largely be resolved through 
discussion. Our goal in every case is to establish as simple and clear a mechanism as 
possible for individuals and organizations. 


One way we have sought to streamline our approach to jurisdictional and related 
investigative issues is to establish a regional private sector privacy forum with Alberta 
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and British Columbia. This forum operates under the authority of the federal and 
provincial Commissioners and seeks to coordinate and harmonize federal and provincial 
oversight of the private sector in Canada. Senior investigations and legal staff from 
each of the Commissioners’ offices take part in monthly teleconferences and twice- 
yearly meetings. The forum serves many functions, but among the most important 
is to develop procedures for determining jurisdiction, transferring complaints and 
conducting parallel investigations. 


Federal and provincial Commissioners have also been working to develop protocols 
for handling investigations where there may be overlapping jurisdiction. In March 
2004, the Privacy Commissioner of Canada sent a letter of understanding to the 
Information and Privacy Commissioners of Alberta, British Columbia, and a similar 
letter to the Ontario Information and Privacy Commissioner in January 2005, to 
confirm discussions about the handling of complaints relating to organizations in 
those provinces. In part, these letters of understanding set out how our Office would 
handle complaints both before and after a finding of “substantially similar” occurs in 
respect of the provincial laws. 


These letters of understanding are available on the Privacy Commissioner of Canada’s 
Web site (www.privcom.gc.ca). There is further information about jurisdictional 
issues, including a fact sheet, on our Web site, as well as on the Web sites of other 
provincial Information and Privacy Commissioners. 


Our Office has had a long-standing relationship with the Commission d’accés a 
l'information (CAT) in Quebec. Quebec was the first Canadian jurisdiction to adopt 
private sector privacy legislation in 1994. In order to take advantage of the rich body of 
jurisprudence accumulated in Quebec since 1994, we have commissioned a document 
to review and summarize Quebec’s experience to date. 


In order to ensure that this may be as helpful as possible to all jurisdictions, we 
established an External Editorial Board to assist in the project. The members are: 


Madeleine Aubé, General Counsel, Commission d’accés a l'information du Québec 

Jeffrey Kaufman, Fasken Martineau, Toronto 

Mary O'Donoghue, Senior Counsel, Ontario Information and Privacy Commissioner's Office 
Murray Rankin, Arvay Finlay, Victoria 

Frank Work, Q.C., Information and Privacy Commissioner of Alberta 


This document was published in August 2005 and is available on our Web site. 
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The Alberta and federal Commissioners have already cooperated in investigating 
issues that have both federal and provincial elements — see for example, the case 
summary relating to a joint federal/provincial investigation of misdirected medical 
information mentioned below in the section on Incidents under PIPEDA. In another 
case, Edmonton police conducting an investigation found information used in 
determining security clearances for Alberta government employees. The information 
included credit reports. The aspects of the investigation relating to correction of 
erroneous credit reports fell to the Alberta Information and Privacy Commissioner, 
while our Office handled the systemic issue of retention of credit reports. 


While the constitutional pitfalls may be numerous, we hope a practical approach to 


the application of the way personal information protection legislation in Canada will 
yield, overall, effective privacy protection in Canada. 
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Evolution of the Personal Information 
Protection and Electronic Documents Act 


Statutory Changes 


PIPEDA Amendments 

The Public Safety Act, 2002! included two amendments to PIPEDA. Their effect is 
to permit organizations to collect and use personal information without consent for 
the purposes of disclosing this information when required by law or to government 
institutions if the information relates to national security, the defence of Canada or 
the conduct of international affairs. 


The Commissioner appeared before the Senate Standing Committee on Transport 
and Communications on March 18, 2004, to voice her concerns about these 
amendments.” In her statement to the Committee, the Commissioner pointed out 
that the amendments will allow organizations to act as agents of the state by collecting 
information without consent for the sole purpose of disclosing it to government 
and law enforcement agencies. She asked that the changes to PIPEDA be dropped, 
and expressed concern that the wording of these changes was so broad that they 
could apply to any organization subject to PIPEDA, with no limit on the amount of 
information to be collected or the sources of the information. 


The Public Safety Act, 2002, without the changes recommended by the Commissioner, 
came into force on May 11, 2004. 


' See http://www.parl.gc.ca/PDF/37/3/parlbus/chambus/house/bills/government/C-7_4.pdf 
* See http://www.privcom.ge.ca/speech/2004/sp-d_ 040318 _e.asp 
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Amendments to Other Acts 

The Federal Court Rules, 1998 were enacted before PIPEDA. Because of this, rule 
304(1)(c), which deals with service of a “notice of application’, had no reference 
to PIPEDA. Accordingly, in February 2003 our Office’s Legal Branch requested 
an amendment to rule 304(1)(c) to include notifying the Privacy Commissioner 
whenever an application is filed under PIPEDA, as well as when one is filed under 
the Privacy Act. 


The Rules Amending the Federal Court Rules, 1998 came into force on November 29, 
2004 and were published in the Canada Gazette, Part II of December 15, 2004 as 
SOR/2004-283. Section 16 of this document amended rule 304(1)(c) to include 
PIPEDA so that the text of that section now reads: 


[...] 304(1)(c) where the application is made under the Access to 
Information Act, Part 1 of the Personal Information Protection and 
Electronic Documents Act, the Privacy Act or the Official Lan guages Act, 
the Commissioner named for the purposes of that Act; and [...] 


2006 Review of P/PEDA by Parliament 


The Office has been preparing for the upcoming review of PIPEDA by Parliament, 
scheduled to take place in 2006. The year 2006 may appear a long way off from the 
vantage point of this 2004 Annual Report, but our experience over the past four 
years in overseeing the application of the law has convinced us that this a good time 
to begin preparing, and that our Office is also the right place to begin. This Office 
will be active in developing policy positions to make the operation of the law simpler 
and more effective for organizations and individuals alike, and to ensure that the fair 
information practices at the heart of PIPEDA are translated into practice. 


Like any significant new law, PIPEDA has its problems. It is hard to get the first 
version of any law completely “right”, particularly when it is breaking new ground 
and providing new rights and obligations. We don’t have all the solutions for these 
problems, but we have identified several issues and, in some cases, suggested possible 
ways to address them. 
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¢ Scope 


¢ Does PIPEDA deal effectively with employee information? Many of our 
complaints arise in the context of the employer/employee relationship. 
The current PIPEDA doesn't always fit that relationship. Both the B.C. 
and Alberta private sector legislation deal with employee information 
under a separate set of rules. 


- There are clear overlaps between PIPEDA and the Canada Labour Code 
and between the mandate of the Office of the Privacy Commissioner and 
that of labour arbitrators. 


- There remains uncertainty about the distinction, if there is one, between 
“commercial” activity, as defined in the Act, and “professional” services. 


- Elsewhere in this report, we describe a case that involved sending 
unsolicited commercial e-mail to a business e-mail address. The legislated 
definition of “personal information” excludes certain business information 
such as address and phone number. Should business e-mail addresses also 


be excluded? 
¢ (Consent 


- Consent is at the heart of PIPEDAZ. It is also one of the most problematic 
issues under the Act. For example, must an organization obtain the 
consent of all its customers when it proposes to disclose their information 
in the context of a business merger or acquisition? That seems to be what 
the law requires, but it is not always practicable for several sound business 
reasons. The B.C. and Alberta private sector laws both deal with this 
issue head-on and establish rules to protect customer information in 
these circumstances. Should PIPEDA do the same? 


¢ Oversight 


- PIPEDA gives the Commissioner the powers of an ombudsman — in other 
words, no power to issue an order or levy a penalty against an organization 
violating PIPEDA. While we think that the ombudsman model works 
well overall (in fact, even in jurisdictions that have order-making powers 
on privacy matters, the vast majority of cases are settled without an 
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order) we are aware that oversight bodies in other jurisdictions have 
enforcement powers. Parliament may want to consider the advantages 


and disadvantages of both models in its 2006 review of PIPEDA. 


These are simply a few of the issues that may need to be addressed in the five year 
review of the Act. 
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n 2004, PIPEDA reached its full extension, to cover all commercial activities in 

provinces without substantially similar legislation. Over the year, we saw a significant 

spike in complaints filed under PIPEDA: we received 723 complaints between 
January 1 and December 31, more than double the 302 received in the previous 
calendar year. The expansion of the Act’s coverage appears to be a considerable factor 
in the increase. Financial institutions were once again the most frequent object of 
complaints, as one might expect given the vast quantities of personal information that 
pass through their hands. They were followed by the telecommunications sector, also 
a front-runner in years past. But complaints in four areas new to us — insurance, sales, 
accommodation, and professionals — accounted between them for over 25 per cent of 
the complaints. It remains to be seen whether we will see further increases, as the Act 
becomes better known to Canadians. 


PIPEDA COMPLAINTS RECEIVED BETWEEN JANUARY 1 AND DECEMBER 31, 2004 


Sectoral Breakdown 


Sector _ Count Percentage 
Financial Institutions 212 29.3% 
Telecommunications 125 17.3% 
Insurance 82 11.3% 
Sales 82 11.3% 
Transportation 67 9.3% 
Health 36 5% 
Accommodation 18 2.5% 
Professionals 15 2.1% 
Services 10 1.4% 
Other 76 10.5% 
Total 723 100% 
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The complaints related to the following concerns: 


Breakdown by Complaint Type 


Complaint type Count Percentage 
Use and Disclosure 286 39.6% 
Collection 172 23.8% 
Access A12 15.5% 
Safeguards 40 5.5% 
Consent 3/ 5.1% 
Accuracy 22 3% 
Correction/Notation Id 1.5% 
Fee 12 1.7% 
Other 4 0.6% 
Retention 6 0.8% 
Accountability 9 1.2% 
Time Limits 9 1.2% 
Challenging Compliance 1 0.2% 
Openness 2 0.3% 
Total 723 100% 


During the year, we closed 379 complaints. This is an improvement over the previous 
§ they P P P 
year, where we closed 278. Nonetheless, in both years we received more complaints 


than we closed. This presents the Office with the risk of a developing backlog. 


We are taking initiatives to address this, including reallocating resources and reviewing 
the way in which we conduct our investigations. One of the most promising approaches 
may be a new emphasis, since January 2004, on a category of complaint disposition, 
“Settled during the course of the investigation.” These are cases in which, during the 
investigation, we have helped bring about a solution satisfactory to all parties. 
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COMPLAINT INVESTIGATIONS TREATMENT TIMES — P/PEDA 


This table represents the average number of months it has taken to complete a complaint investigation 
by disposition, from the date the complaint is received to when a finding is made. 


By Disposition 
For the period between January 1 and December 31, 2004. 


Disposition Average Treatment Time in Months 
Early resolution 

Discontinued 5.6 
Settled 7.2 
No jurisdiction 7.8 
Overall average 8.3 
Resolved 10.5 
Not well-founded 11.0 
Well-founded 11.0 
Overall Average 8.3 

By Complaint Type 


For the period between January 1 and December 31, 2004. 


Complaint Type Average Treatment Time in Months 
Fee 4 
Accuracy 6.4 
Consent 6.9 
Time Limits 8.1 
Use and Disclosure 8.2 
Access 8.3 
Safeguards 8.4 
Correction/Notation 8.5 
Collection 8.9 
Retention 9.5 
Accountability 12.0* 
Challenging compliance 120% 
Overall average 8.3 


* The average treatment times for these two complaint types in fact represent one case for each. 


Settling complaints in investigation is not new, but our emphasis on it is. In 2003, 
settled cases represented two per cent of our completed cases. In contrast, of the 379 
cases concluded in 2004, 152 — just over 40 per cent — fell in the “settled” category. 
This was by far the most frequent disposition of our cases. 
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This new emphasis on settlement is an important element in dealing with the volume 
of complaints that we face. Over the course of the year, settlement of a complaint 
took, on average, less time than any other complaint resolution except discontinuance 
(where, for instance, the complainant may no longer want to pursue the matter 
or cannot be located) or early resolution, where the issue is dealt with before any 
investigation takes place. 


If we take the figures for the “settled” and “early resolution” categories, we can see 
that 45 per cent of our complaints are concluded without the investment of resources 
entailed in a complete investigation. This is welcome news to an organization facing 
an increasing workload. 


That we were able to settle so many of our cases suggests that organizations and 
individual complainants welcome the opportunity to resolve complaints expeditiously 
and pragmatically. This fits well with our ombudsman role; we are in this business, 
after all, to help people resolve problems. At the same time, of course, we have a 
responsibility to ensure that the public policy intentions of PIPEDA are respected. 
Our Office, as much as the complainant and the organization, has an interest in 
any settlement; our view, however, is that enthusiasm for settlement does not mean 
settling complaints at any cost. Our investigators work closely with the parties in the 
settlement process to ensure that systemic issues raised in a complaint are addressed. 


COMPLAINTS CLOSED BETWEEN JANUARY 1 AND DECEMBER 31, 2004: TYPE OF CONCLUSION 


a Discontinued 
No jurisdiction 
Settled 

FE] Resolved 


arly resolution 


[__]well-founded 


i Not well-founded 
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Definitions of Complaint Types under P/PEDA 
Complaints received in the Office are categorized according to the principles and 
provisions of PIPEDA that are alleged to have been contravened: 


Access. An individual has been denied access to his or her personal information 
by an organization, or has not received all his or her personal information, either 
because some documents or information are missing or the organization has 
applied exemptions to withhold information. 

Accountability. An organization has failed to exercise responsibility for personal 
information in its possession or custody, or failed to identify an individual 
responsible for overseeing its compliance with the Act. 

Accuracy. An organization has failed to ensure that the personal information that 
it uses is accurate, complete, and up-to-date. 

Challenging compliance. An organization has failed to put procedures or policies in 
place that allow an individual to challenge its compliance with the Act, or has 
failed to follow its own procedures and policies. 

Collection. An organization has collected personal information that is not necessary, 
or has collected it by unfair or unlawful means. 

Consent. An organization has collected, used, or disclosed personal information 
without valid consent, or has made the provision of a good or service conditional 
on individuals consenting to an unreasonable collection, use, or disclosure. 
Correction/Notation. [he organization has failed to correct personal information as 
requested by an individual, or, where it disagrees with the requested correction, 
has not placed a notation on the information indicating the substance of the 
disagreement. 

Fee. An organization has required more than a minimal fee for providing 
individuals with access to their personal information. 

Retention. Personal information is retained longer than necessary for the fulfillment 
of the purposes that an organization stated when it collected the information, or, 
if it has been used to make a decision about an individual, has not been retained 
long enough to allow the individual access to the information. 

Safeguards. An organization has failed to protect personal information with 
appropriate security safeguards. 

Time Limits. An organization has failed to provide an individual with access to his 
or her personal information within the time limits set out in the Act. 

Use and Disclosure. Personal information is used or disclosed for purposes other than 
those for which it was collected, without the consent of the individual, and the use 
or disclosure without consent is not one of the permitted exceptions in the Act. 
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Investigation Process under PIPEDA 


Inquiry: 
Individual contacts OPC by ietter, by telephone, or in person to complain of violation of Act. Individuals who make contact in person 
or by telephone must subsequently submit their allegations in writing. 


+ 


Initial analysis: 
Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


An individual may complain about any matter specified in sections 5 to 10 of the Act or in Schedule 1 — for example, denial of 
access, or unacceptable delay in providing access, to his or her personal information held by an organization; improper collection, 
use or disclosure of personal information, inaccuracies in personal information used or disclosed by an organization, or inadequate 
safeguards of an organizations holdings of personal information. 


v . 
Saree Complaint? par 
No: Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


investigation: 
The investigation will serve to establish whether individuals’ privacy rights have been 
contravened or whether individuals have been given their right of access to their personal 
information. 


Early resolution? 
: Acomplaint may be resolved 
| before an investigation is : 
, undertaken if, for example, the} 
, suehas already beenfully =| ~The investigator writes to the organization, outlining the substance of the complaint. 

: The investigator gathers the facts related to the complaint through representations from 

both parties and through independent inquiry, interviews of witnesses, and review of 

documentation. Through the Privacy Commissioner or her delegate, the investigator has 
ee aeaaea ec ibe tree . the authority to receive evidence, enter premises where appropriate, and examine or 


obtain copies of records found on any premises. 


Analysis (on next page) 


I 
dealt with in another complaint 
1 and the organization has ceased 
: the practice, 

| 


oT] 
1 
i] 
1 
i] 
1 
LJ 
1 
i] 
1 
1 
1 
1 
a 


; 
i] 
1 
i] 
1 Discontinued? | 
+ Acomplaint may be 4 ' 
discontinued if, for , ; 
1 example, a complainant 1 : 
v 
Settled? (on next page) 
i] 
1 


1 fs . 
decides not to pursue it, 
or a complainant cannot 


1 
t 
1 
be located. 
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1 

Analysis: 

1 The investigator analyses the facts and prepares recommendations to the Privacy Commissioner or her delegate. 
: The investigator will contact the parties and review the facts gathered during the course of the investigation. 

; The investigator will also tell the parties what he or she will be recommending, based on the facts, to the Privacy 
Commissioner or her delegate. At this point, the parties may make further representations. 
1 
! 
1 
i] 
1 
t 


Analysis will include internal consultations with, for example, Legal Services or Research and Policy Branches, as 


appropriate. 
1 
! ! 
La AS Ea gg ae iri eo a a 2 I 
Bh ee wy 
Settled? | Findings: 
The OPC seeks to The Privacy Commissioner or her delegate reviews the file and assesses the report. The Privacy 
resolve complaints : Commissioner or her delegate, not the investigator, decides what the appropriate outcome should 
and to prevent ; _ beand whether recommendations to the organization are warranted. 
. i] 
ee e | _ The Privacy Commissioner or her delegate sends letters of findings to the parties. The letters outline 
from recurring. =, ' ; ' 
ah the basis of the complaint, the relevant findings of fact, the analysis, and any recommendations to the 
The Commissioner! tea i ae Ady Manner 
Bes organization. The Privacy Commissioner or her delegate may ask the organization to respond in writing, 
9 1 within a particular timeframe, outlining its plans for implementing any recommendations. 
resolution through 1 
mediation, | The possible findings are: 
negotiation and | 
ph The | Not Well-Founded: The evidence, on balance, does not lead the Privacy Commissioner or her delegate to 
? 1 . ee 
investigator assists conclude that the complainant's rights under the Act have been contravened. 
in this process. Well-Founded: The organization failed to respect a provision of the Act. 
tee e------ + Resolved: The evidence gathered in investigation supports the allegations raised in the complaint, but the 


organization agreed to take corrective measures to rectify the problem, to the satisfaction of this Office. 


In the letter of findings, the Privacy Commissioner or her delegate informs the complainant of his or her 
rights of recourse to the Federal Court. 


| Where recommendations have | 
' been made to an organization, | 
OPC staff will follow up to 1 
verify that they have been 
i 

i} 


i] 
1 
t 
t 
; implemented. 


' Federal Court for a hearing of the matter. The Federal Court has the power 
to order the organization to correct its practices, to publish a notice of 

any action taken or proposed to correct its practices. The Court can award 
damages to a complainant, including damages for humiliation. There is no 
ceiling on the amount of damages. 


Note: a broken line (- - - - ) indicates a possible outcome. 
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Definitions of Findings under PIPEDA 


The Office has developed a series of definitions of “findings” to explain the outcome 
of its investigations under PIPEDA: 


Not well-founded: This means that the investigation uncovered no or insufficient 
evidence to conclude that an organization violated the complainant’s rights 


under PIPEDA. 


Well-founded: This means that an organization failed to respect a provision of 
PIPEDA. 


Resolved: ‘This means that the investigation substantiates the allegations, but 
that the organization has taken or has committed to take corrective action to 
remedy the situation, to the satisfaction of our Office. 


Settled during the course of the investigation: This means that the Office has 
helped negotiate a solution that satisfies all involved parties during the course 
of the investigation. No finding is issued. 


Discontinued: I’his means that the investigation ended before a full investigation 
of all the allegations. A case may be discontinued for any number of reasons 
— for instance, the complainant may no longer want to pursue the matter or 
cannot be located to provide information critical to making a finding. 


No jurisdiction: ’his means that the investigation leads to a conclusion that 
PIPEDA does not apply to the organization or to the activity that is the 
subject of the complaint. 


Early resolution: [’his is a new type of disposition. It applies to situations where 
the issue is dealt with before a formal investigation occurs. For example, if an 
individual files a complaint about a type of issue that the Office has already 
investigated and found to comply with PIPEDA, we would explain this to 
the individual. “Early resolution” would also apply when an organization, 
on learning of allegations against it, addresses them immediately to the 
satisfaction of the complainant and this Office. 
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FINDINGS BY COMPLAINT TYPE : 
Complaints closed between January 1 and December 31, 2004 | 


Discontinued Early No NotWell- Resolved Settled Well- TOTAL 
Resolution Jurisdiction founded founded 

Access 10 3 Z 8 5 20 14 62(16%) 
Accountability 0 0 0 0 0 1 0 1 (0%) 
Accuracy 2 1 0 1 0 1 0 5 (1%) 
Challenging 0 0 0 0 0 0 1 1 (0%) 
Compliance 
Collection 10 2 1 25 15 30 13 96 (25%) 
Consent 2 1 0 0 0 3 1 7 (2%) 
Correction/ 0 0 0 0 0 1 1 2 (1%) 
Notation 
Fee 0 2 1 0 0 2 0 5 (1%) 
Retention 0 0 0 0 1 1 0 2 (1%) 
Safeguards 0 0 1 2 0 13 2 18 (5%) 
Time Limits 0 0 0 2 1 3 1 7 (2%) 
Use and 22 10 1 25 5 198 33 173 
Disclosure (46%) 
TOTAL 46 19 6 63 27 152 66 379 
(# and %) (12%) (5%) (2%) (17%) (7%) (40%) (17%) 
Inquiries 


The Inquiries Unit responds to requests for information from the public about the 
application of PIPEDA as well as the Privacy Act. The Office receives thousands of 
inquiries each year from the public and organizations seeking advice on private sector 
privacy issues. 


In 2004, the Office received 12,132 PIPEDA inquiries, down from 2003, when we 
received 13,422. The decline may be attributable to greater understanding of PIPEDA 
among the organizations that are subject to it; in 2003, many organizations were 
searching for guidance as they anticipated the full implementation of PIPEDA on 
January 1, 2004. 


In the course of the year, staff shortages in the Inquiries Unit coupled with the 
ongoing heavy volume of work have presented challenges. As a result, it was necessary 
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to reassess the way we respond to public inquiries. We no longer accept or respond to 
inquiries or complaints by e-mail. We introduced an automated telephone system to 
answer the public’s most frequently asked questions such as those about identity theft, 
telemarketing and, of course, the social insurance number. And we continue adding 
information to our Web site to answer the most frequently asked questions. We 
also temporarily assigned some investigators to help the unit. Lastly, we now invite 
individuals to telephone during office hours since we can often determine a caller's 
needs faster and better in person than in a series of e-mails and letters. 


INQUIRIES STATISTICS 


January 1 to December 31, 2004 


The following table represents the total number of PIPEDA inquiries responded by the Inquiries 
Unit. 


Telephone inquiries 8,861 
Written inquiries (letter, email or fax) 3,271 
Total number of inquiries received 12,132 


Inquiries Response Times 


On average, written inquiries (one quarter of the workload of the Unit) were responded 
to within three months. Nearly 3/4 of our inquires were received by telephone. The 
majority of these were responded to immediately; the remainder, which may have 
required research, were responded to within one to two weeks. 


Providing written responses to inquiries is very time consuming and labour intensive. 
Over the year, the Inquiries Unit accrued a backlog of inquiries which exacerbated the 
average monthly response times. As we implement new measures, we will monitor 
the situation to determine whether these changes have resulted in efficiency gains. 
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Select Cases under PIPEDA 


The following cases illustrate the breadth and variety of the cases investigated by our 
Office. We also posted 29 summaries of findings for 2004 on our Web site. 


Medical information divulged through indiscreet choice of words 


Even with the best of intentions, and even in such seemingly harmless activities 
as arranging for a taxi, health professionals must watch what they say to company 
managers about employees’ health situations. 


The facts 

After completing a substance abuse program, a complainant signed a “last chance” 
contract as a condition of continued employment with a national transportation 
company. This contract required him to submit to regular monitoring, as well as 
random drug and alcohol testing, by the company’s health service provider. The 
complainant was very concerned about confidentiality and for the most part had 
managed to keep his situation from fellow employees and supervisors. 


One day while he was at home on active furlough, he received a call from a nurse, who 
told him he had to be at the clinic within four hours to give a urine sample. When he 
told the nurse he had no way of getting there, she said she would call the company 
and arrange for a taxi. The complainant soon got a call from his supervisor, who told 
him a taxi would take him “to the lab”. The supervisor then asked him whether he was 
« ” 2 

under contract” — meaning a last-chance contract. 


From the supervisor’s words, the complainant assumed that the nurse had revealed 
too much information about him. Angered by what he believed to be a breach of 
his confidentiality, he later confronted both the nurse and the supervisor in abusive 
language that the company deemed to be grounds for disciplinary action. An 
investigation ensued, and the complainant was eventually dismissed for conduct 
unbecoming an employee (he has since been reinstated). 


The supervisor told our Office that he had assumed the complainant’s involvement in 
the substance abuse monitoring program from the nurse’s use of the words “test” and 
“clinic” in his telephone conversation with her. The nurse, on the other hand, told us 
that she had used the word “appointment”, not “test”. She claimed to have given the 
supervisor only the minimum information necessary to make it clear that a taxi was 
needed and that there was a reasonable basis for the company to pay for it. 
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At one point, the company’s regional superintendent had asked the nurse to document 
her version of the events relating to the complainant’s alleged misconduct. She did 
so in an e-mail, which was sent to the regional superintendent and later forwarded 
to two other senior managers. In the e-mail, the nurse stated that the complainant 
had been required to undergo a “medical test ... to assure his continuing fitness for 
duty” and that he had had to take the test within four hours after her phone call to 
him. Believing that this information implied his participation in the program, the 
complainant objected that it had been conveyed to the parties in question. 


The complainant’s allegation to our Office was that the nurse had inappropriately 
divulged his personal information to his supervisor in a telephone conversation and 
to other senior managers in an e-mail message. 


Our findings 

With respect to the telephone conversation, though it seemed appropriate that the 
nurse would have had to provide the supervisor with a reason to justify the taxi request, 
our investigation could not establish what exactly she had said to the supervisor. 
Whatever wording she used, it either caused the supervisor to conclude, or confirmed 
his suspicion, that the complainant was in the substance abuse monitoring program. 


Similarly with respect to the e-mail, we did not dispute the need to inform 
senior managers of the complainant’s alleged misconduct, but the problem was 
the information’s content. Since the nurse’s purpose had been to document the 
complainant’s behaviour, stating that he had been required to go for a medical test 
within four hours was superfluous. The words “medical appointment” would have 
been sufficient to explain the need for a taxi. 


The company was therefore found to have inappropriately used the complainant’s 
personal information in contravention of Principle 4.3 of the Act. The complaint was 


well-founded. 


Professor objects to getting spammed at the office 


Is a person's business e-mail address fair game for marketers? 


The facts 

At his university office, a complainant received an unsolicited commercial e-mail 
promoting season's tickets for a professional team’s games. The sales agent in question 
admitted to having obtained the e-mail address from the university’s Web site, and he 
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agreed not to send the complainant further e-mails without his consent. Two weeks 
later, however, the complainant received a second e-mail solicitation from the same 
organization, but a different sales agent. 


The complainant’s allegation to our Office was that the organization had collected 
and used his personal information without his consent. 


The organization did not dispute that it had sent the complainant a solicitation at his 
office e-mail address on two occasions. The two sales representatives in question were 
each responsible for a different solicitation “program” — one the “university program’, 
and the other the “lawyer program’. The agent responsible for the lawyer program had 
generated his contact list from the Web site of a law firm with which the complainant 
was associated. There was no cross-referencing system in place to flag the complainant’s 
previous request that his name be deleted from the organization's marketing lists. 


In response to the complaint, the organization removed the complainant’s name from 
all its marketing lists and instituted cross-selling controls to ensure similar treatment 
of any future objection. The organization has also engaged a new ticketing and sales 
firm that is more knowledgeable about the requirements of PIPEDA. 


The view of the university in question is that the e-mail addresses of its staff are 
business information. The university generally requires its faculty members to agree 
to have their business e-mail addresses published, in accordance with its business 
model and its expectation that employees be easily accessible. However, the university 
also expects a business or organization to obtain permission before contacting faculty 
for purposes unrelated to promoting the university's interests. 


Section 2 of the Act specifically excludes the name, title, or business address or phone 
number of an employee of an organization from the definition of personal information, 
but makes no mention of an employee’s business e-mail address. Sections 7(1)(d) 
and 7(2)(c.1) stipulate that an organization may collect and use personal information 
without the individual’s knowledge and consent if the information is publicly available 
and specified in the regulations. 


The regulations applying to these sections state that publicly available information 
includes an individual’s name, title, address, and telephone number appearing in a 
professional or business directory, listing, or notice that is available to the public, 
where the collection, use, and disclosure of the personal information relate directly to 


the purpose for which the information appears. 


Se ee 


45 


ANnuat Report To PARLIAMENT 2004 - Report ON PERSONAL INFORMATION PROTECTION AND ELEcTRonic Documents Act 


Our findings 

We determined first that, since section 2 does not specify a business e-mail address as 
being among the excluded types of information, it must therefore be deemed personal 
information for purposes of the Act. 


The question then to be considered was whether the sports organization could rely on 
the exceptions to consent set out in sections 7(1)(d) and 7(2)(c.1). 


The university had listed faculty e-mail addresses on its Web site with the expectation 
that businesses, organizations, and individuals might contact faculty members to 
further the university’s interests. The sale of season’s tickets to a sporting event, 
however, was not related to that purpose. The same reasoning applied to the Web 
site of the firm with which the complainant was associated. Moreover, even after 
the complainant’s initial objection, the organization had collected his e-mail address 
from that other source and used it again for marketing purposes against his explicit 
instructions. 


In sum, we determined that, since the purposes for which the organization had 
collected and used the complainant’s personal information was entirely unrelated to 
the reason for which the information had been published, the organization could not 
rely on the exceptions to consent. The organization had thus collected and used the 
complainant’s personal information without his consent, in contravention of Principle 
4.3 of the Act. The complaint was well-founded. 


Video surveillance as a last resort 


Our Office considers video surveillance an extremely privacy-invasive form of 
technology. The medium’s very nature entails the collection of a great deal of 
personal information, much of which may relate to innocent third parties, may 
be extraneous, or may lead to judgments about the subject that have nothing to 
do with the original purpose for collecting the information. 


Only as a last resort should companies use video surveillance for investigative 
purposes - especially in investigating employees away from the workplace. 


The facts 

Over the course of his employment with a company, a complainant had reported 
a number of work-related injuries and had eventually requested workplace 
accommodation for physical limitations. For almost two years, the company 
attempted to satisfy his accommodation requests, but to no avail. The complainant 
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grew increasingly dissatisfied with the company’s efforts, unwilling to: perform his 
work duties, and resistant to the company’s repeated requests for up-to-date medical 
information. 


In view of the complainant’s behaviour and lack of cooperation in providing accurate 
information about his ability to perform certain job-related tasks, the company 
became increasingly suspicious about the extent of his physical limitations. It 
eventually requested that he undergo an independent medical assessment, which he 
initially refused but in the end accepted. The independent assessors concluded that, 
although the complainant did have physical limitations, there also appeared to be 
many “non-physical barriers” to his returning to work. The assessors also noted that 
further functional testing would be unlikely to provide an accurate assessment of the 
complainant’s true functional abilities. 


Two months later, while the complainant was on leave, the company hired a private 
investigator to conduct surveillance on him with a view to determining whether he was 
being truthful about his physical limitations. After two weeks, the investigator provided 
the company with a report and eight hours of videotape showing the complainant 
performing tasks of which he had claimed to be incapable. On this evidence that he had 
misrepresented the state of his health, the company dismissed him. 


The complainant’s allegation to our Office was that his employer had collected his 
personal information by way of video surveillance without his knowledge and consent 
and had used that information to terminate his employment. 


To justify its actions in this case, the company relied on sections 7(1)(b) and 7(2)(d) 
of the Act. These provisions permit an organization to collect and use personal 
information without the individual’s knowledge and consent if seeking knowledge 
and consent would compromise the availability or the accuracy of the information 
and if the collection and use are reasonable for purposes of investigating a breach of 
an agreement or a contravention of a law. 


The company maintained that its decision to conduct video surveillance was the 
result of consultation among a small team of legal, medical, and industrial-relations 
professionals, who had determined that such a measure was necessary as a last resort 
in the circumstances. The company had provided information about the complainant's 
physical limitations and had instructed the investigator to monitor the complainant’s 
activities over a significant-enough period to provide a complete picture of his capability 
and establish sound, factual, and irrefutable evidence of his fraudulent behaviour. The 
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company acknowledged, however, that it had no formal policy or procedures in place 
to guide managers in such situations. 


Our findings 

There was no question that the company had collected the complainant's personal 
information through video surveillance without his knowledge and consent. The 
issue was whether section 7(1)(b) could apply. However, this exception could not be 
read in isolation. Among the factors to consider were whether the organization had 
substantial evidence to support the suspicion that the relationship of trust had been 
broken, could show that it had exhausted all other means of obtaining the information 
that it required in less privacy-invasive ways, and had limited the collection to the 
purposes as far as possible. 


On the evidence, our Office was satisfied that the company’s purpose of determining 
whether the complainant was violating his employment contract by misrepresenting 
the state of his health was based on substantial evidence. Furthermore, the company 
had made numerous less privacy-invasive attempts to gather the information it had 
required, but these had mostly met with resistance from the complainant and in the 
end had not dispelled the organization’s concerns. It had also, in taking the step of 
hiring the private investigator, outlined what information it was seeking and focused 
the collection of personal information as far as possible. 


In sum, the company had had reasonable cause to believe that the complainant was 
violating his employment contract, and had clearly had difficulty in obtaining accurate 
information from him with his knowledge and consent. We accepted the company’s 
reliance on sections 7(1)(b) and 7(2)(d) to collect and use the complainant’s personal 
information without his knowledge and consent. The complaint was not well- 


founded. 


Notwithstanding the findings, we recommended that the company formalize the 
measures it had taken by developing privacy-conscious policy and practices regarding 
the use of video surveillance. Such policy should consider the following: 


e Video surveillance is a last resort and should only be contemplated if all other 
avenues of collecting personal information have been exhausted. 

e The decision to undertake video surveillance should occur at a very senior level of 
the organization. 
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e The private investigator should be instructed to collect personal information 
in accordance with the Act, and should be especially mindful of Principle 4.4 
(Limiting Collection). 


The company implemented this recommendation. 


Cameras in the workplace: The importance of stating purposes 


Employees naturally tend to resent the presence of video cameras on the job. 
However, by being forthcoming about purposes, the employer can often alleviate 
employees’ fears about loss of privacy. 


The facts 

Implementing a recommendation from a security review, a broadcasting company 
installed three surveillance cameras at its workplace — one outside and two inside the 
building. The outside camera captured the parking lot and building entrance, and the 
inside cameras aimed at the interior entrance and a central corridor. 


Several employees of the company lodged complaints with our Office, alleging that 
the company was using the cameras to collect their personal information, particularly 
about their behaviour and work performance. 


The employer maintained that a memorandum had been posted to inform employees 
of the camera installation and its true purpose, which was to ensure the safety and 
well-being of employees by tracking non-employee traffic in and out of the building. 
The employees, however, were not aware of the memorandum. 


During our investigation, the company agreed to inform employees of the purposes 
for which information collected by the cameras would be used. It also agreed to 
develop a policy document on the use of surveillance cameras, including the objectives, 
installation sites, employees authorized to operate the system, time of surveillance 


and recording, and applicable equity principles. 
The company subsequently fulfilled these commitments. 
Our findings 


The company had not made reasonable efforts to inform its employees and had 
thereby violated Principle 4.3.2 of the Act. 
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However, it was also established that the use of such a surveillance system constituted 
an appropriate means of protecting employees. Since the cameras were not to be used 
to collect employees’ personal information and were not installed in places where 
there was a reasonable possibility of privacy invasion, it did not seem appropriate 
that the employer be required to obtain employees’ consent for their use. If the 
cameras inadvertently collected employees’ personal information, the employer would 
not be able to use such information without the employees’ consent except in the 
circumstances set out in the sections 7(2)(a) and (b) of the Act (these provisions apply 
to legal investigations and emergencies, respectively). 


Because of the company’s commitments to inform employees and develop a policy 
document, the complaints were deemed resolved. 


Cameras in the workplace: The importance of keeping to reasonable purposes 


In this case, our Office supported the use of video cameras to enhance the 
safety of the workplace, but warned that the unrestrained use of such cameras 
to monitor employee productivity or to manage the employer/employee 
relationship would have a chilling effect on employee morale. Employers using 
cameras for legitimate operational purposes must make every effort to keep to 
those purposes, and must exercise great care and deliberation in resorting to 
video surveillance for any exceptional purposes allowable under the Act. 


The facts 

A railway company uses cameras to monitor train movements and to inform crew 
members of train locations. The company installed the cameras after a risk analysis, 
and both the company and the employee union agree that the cameras are needed for 
operational purposes. 


One day the manager responsible for the cameras spotted two on-duty employees 
getting into a car. He went into his office and used the cameras’ zoom capacity to 
determine that the employees were driving off site. The company subsequently 
imposed a disciplinary penalty against them for leaving work without permission. 
One of the two employees grieved the discipline, and the matter was referred to 
arbitration. Both employees complained to our Office that the company had used 
video cameras, ordinarily used for operational purposes, to determine that they were 
leaving company property during regular working hours. 
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The company argued initially that the Commissioner should exercise her discretion 
not to issue a report of findings, since the matter was also being dealt with through 
arbitration. Referring to a recent decision of the Federal Court to the effect that 
labour tribunals have exclusive jurisdiction over disputes arising out of collective 
agreements, the company later contended that the Commissioner’s Office did not 
have jurisdiction with respect to such complaints. 


The company also argued that the Act allows organizations to collect, use, and 
disclose information for purposes that a reasonable person would consider appropriate 
in the circumstances. It denied actually having collected the complainants’ personal 
information, since the camera did not record. It described the camera as a “visual aid” 
that had allowed the manager to follow up on a concern he had already identified 
without the use of a camera. It maintained that the complainants had had no 
reasonable expectation of privacy, given that the rail yard was constantly busy with 
pedestrian traffic. It contended that, given the complainants’ suspicious behaviour on 
the day in question, a reasonable person would have considered it appropriate to use 
the cameras as a visual aid to determine the direction of their vehicle. 


Finally, the company referred to section 7(1)(b) and argued that, should the 
Commissioner conclude that the camera had indeed collected the complainants’ 
personal information, their consent to the collection and use of the information had 
not been required since the company was investigating a breach of an employment 
condition at the time. 


Our findings 

The Office observed first that the Federal Court decision to which the company 
had referred was under appeal. We therefore concluded that we had jurisdiction to 
investigate the complaints. 


The Office also declined to exercise its discretion not to deal with the complaints. 
We referred to the lead role of the Office in determining whether organizations are 
adhering to the Act and in educating both organizations and the public about the Act. 
We noted that the complaints raised issues that could set a precedent. 


We concluded as follows: 
e The Act does not restrict the definition of personal information to information 


that is recorded only, but rather clearly defines personal information as including 
any information about an identifiable individual. The cameras in question do 


51 


Annuat Report To PARLIAMENT 2004 - Report ON Personal INFORMATION ProTecTION AND ELectronic Documents AcT 


collect the personal information of employees, and were used to collect the 
complainants’ personal information — that is, the fact that they were leaving the 
yard during work hours. 


e There is no question that the customary use of the cameras to enhance the safety 
of the workplace is appropriate in the circumstances, as contemplated by section 
5(3) of the Act. The cameras were installed after a risk analysis, and both union 
and management support their use. 


e Regarding the appropriateness of using the cameras in the circumstances 
surrounding the complaints, the company did not present any evidence that 
unauthorized absences from the workplace were a persistent problem with the 
complainants or with other employees. The company did not present any evidence 
of other, less intrusive efforts it had taken to manage unauthorized absences. A 
reasonable person would not consider it appropriate to use the cameras to manage 
a workplace performance issue. In the circumstances, the use was contrary to 


section 5(3) of the Act. 


e Where an employer suspects that the relationship of trust has been broken, it 
can initiate the collection of information to investigate that breach without the 
consent of the individual. However, the only evidence the company presented to 
suggest a possible breach in the relationship of trust was that the employees in 
question had been seen entering a private vehicle. The company admitted that the 
employees might have been leaving the site with the permission of their immediate 
supervisor and that the manager who used the camera had only determined after 
the fact that the employees left the work site without permission. Cameras being 
highly privacy-intrusive, a decision to use them, even in the circumstances set out 
in section 7(1)(b), must be taken with great care and deliberation. Where there is 
a less intrusive method of achieving the same result, that method should be the 
first choice. 


We concluded that the complaints were well-founded. 


52 


CompLainTs 


— Sh— i ss—sSsS—h 


Bank customers required to declare citizenship 


This complaint, specifically about a bank’s collection and use of personal 
information, also raised a general concern about whether a bank was putting the 
requirements of foreign legislation ahead of the privacy interests of its Canadian 
customers. 


The facts 
Several account holders complained when their bank sent them a form letter asking 
them to declare whether or not they were U.S. citizens. 


In 2001, the bank had become an indirect subsidiary of a U.S.-based holding company. 
For purposes of U.S. income tax law, the bank was therefore a “controlled foreign 
corporation’ and was required to comply with applicable U.S. Internal Revenue Service 
(IRS) regulations on information reporting and tax withholding. Notably, it had to 
report interest income earned on personal deposit accounts by persons either known 
to be U.S. citizens or presumed to be U.S. citizens because they had not declared 
themselves non-U.S. citizens. 


The bank mailed an explanatory letter and an account declaration form to all of its 
personal deposit account holders. The letter indicated that, if an account holder did 
not declare that he or she was not a U.S. citizen, his or her name and address, as well 
as the amount of interest income earned, would be disclosed to the IRS. The letter 
also outlined the purpose for collecting such information and how it would be used. 


The complainants alleged that the bank was requiring them to consent to the collection 
and use of more personal information than was needed to provide account services. 


Our findings 

As far as the substance of the complaint was concerned — that is, the collection and 
use of personal information — our Office was of the view that the bank was of putting 
foreign legislation ahead of Canadian customers’ privacy interests. 


As a controlled foreign corporation, the bank was required to comply with applicable 
IRS regulations. Notably, it had to report the interest income earned by U.S citizens, 
but did not have to report that earned by non-U.S. citizens. To ensure provision of 
accurate information to the IRS and to protect the personal information of non-U.S 
citizens, the bank had sent the account declaration form to its account holders, asking 
them to declare whether they were U.S. citizens or non-U.S. citizens. This was a 
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reasonable request, for purposes that a reasonable person would consider appropriate 
in the circumstances, as contemplated by section 5(3) of the Act. 


Furthermore, since the bank had identified its purposes and limited the collection of 
personal information to those purposes, it was also in compliance with Principles 4.2 
and 4.4 of the Act. 


On this account, the complaint was not well-founded. 


Quebec company’s information-sharing notice not clear enough 


If an organization intends to share customers’ names and addresses with third 
parties for marketing purposes, it must let the customers know, but not just in 
any old way. Principle 4.3.2 of the Act puts an onus on organizations to make a 
“reasonable effort” at both bringing purposes to the attention of customers and 
presenting them in a way the customers can understand. 


The company in this case did make an effort, but the question for our Office was, 
“How reasonable?” The case also has an interesting jurisdictional aspect relating 
to a transitional provision in PIPEDA. 


The facts 

Some months after purchasing beauty products by telephone from a company in 
Quebec, a complainant had requested in writing that the company remove her name 
from its mailing list. Several weeks later, in October 2002, her name was still on a list 
that the company had recently sent to an Ontario consultant hired to trade and rent 
its customer lists to other organizations. 


The complainant’s allegation to our Office was that the company had sold her name 
and address to third parties in Ontario without her consent. She also raised concerns 
about the company’s procedure for allowing customers to opt-out of third-party 
marketing. 


The company explained that the continued appearance of the complainant’s name 
on the mailing list was the result of normal administrative delay in processing the 
opt-out request. The company also pointed out that its practice of sharing lists of 
customers’ names and addresses with other businesses, as well as its procedure for 
having one’s name removed from the lists, was set out in a document made available 
to customers in mail-outs and catalogues. 
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Our investigation confirmed the existence of this document. However, the dominant 
title on the document was “Money Back Guarantee”, and the notifications in question 
appeared under the headings “Help Us Conserve Natural Resources” and “Beauty 


Care is Personal”. 


The company removed the complainant’s name from its mailing lists. As a result of 
our Office’s intervention, the company changed its promotional materials to make 
them more understandable. Customers can now simply check a box on the purchase 
order to prevent the sharing of their information. The company also set up a privacy 
committee, which has adopted a policy on the protection of customers’ personal 
information and is developing a similar policy for all employees. 


The complainant expressed satisfaction with the company’s removal of her name from 
its mailing lists and with the changes it made to its promotional materials. 


Our findings 

Under section 30 of PIPEDA, a transitional provision that remained in force for the 
first three years, the Act applied until 2004 to personal information that an organization 
disclosed outside the province for consideration. Even though the company in 
question resides in Quebec, our Office agreed to investigate the complaint under the 
Act because the complainant alleged that the company had disclosed her information 
outside that province for consideration in 2002 — that is, while section 30 was still in 
effect. 


At the time of the complaint, the company’s promotional materials contained a 
notice stating that customers’ names and addresses were shared with third parties and 
laying out a procedure for customers to remove themselves from the lists. However, 
the notice and the removal procedure lacked clarity. The information was hidden 
away under headings that were not representative of the contents. The notice did not 
constitute a reasonable effort by the company to ensure that individuals were clearly 
informed about the secondary disclosure purposes for which the personal information 
was collected. Therefore, the company was in contravention of Principle 4.3.2 of the 
Act, and the complainant’s consent was not meaningful. 


However, since the complainant was satisfied with the outcome of the investigation, 
our Office concluded that the complaint was resolved. 
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Satellite television company alleged to have monitored customers’ viewing habits 


When told to keep his satellite system continuously plugged in, the customer 
assumed the worst of the company. But was its intention really to invade his 
privacy? 


The facts 

A complainant believed that his satellite television provider was keeping track of what 
programs he watched. He was convinced that, in requiring customers to keep their 
telephone lines continuously plugged into receiver boxes, the company’s sole purpose 
was to monitor their viewing habits. 


His allegation to our Office was that the company was indiscriminately collecting and 
using his personal information that it gathered through his telephone connection. 


The company confirmed that it does require its satellite customers to keep their 
telephone lines continuously plugged into the receiver boxes it supplies, but for purposes 
of billing for pay-per-view and preventing piracy, not monitoring viewing habits. The 
company explained, and our Office confirmed, that it was not possible with its current 
technology to monitor any programming other than pay-per-view, since the satellite 
transmission is one-way only and the receiver boxes are not capable of recording other 
programs. The only information the company collects is about the packages a customer 
has purchased and transactions that customers initiate electronically through the pay- 
per-view ordering system, and it collects such information only for billing purposes. 


As for preventing piracy, our Office examined the technical aspects and was satisfied 
that continuous connection with a live telephone line is effective for this purpose. 
Despite the company’s explanation, the complainant continued to believe it was 
collecting more information than necessary to prevent piracy, but he could not provide 
any evidence to support his belief. 


Our findings 
The company’s purposes of billing for pay-per-view and preventing piracy were ones 
that a reasonable person would find appropriate in the circumstances. 


There was no evidence that the company was collecting information on subscribers’ 
viewing habits from the telephone connection. Information on program packages 
and other billing information was collected at the time of purchase, not through a 
telephone line. 
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Although the company did collect pay-per-view information through the connection, 
it did so to meet one of its stated purposes — billing the customer. The continuous 
connection was also effective in fulfilling the company’s other purpose — preventing 


piracy. 


In sum, the company was collecting and using customers’ personal information to 
fulfil reasonable purposes and was not collecting or using excessive information for 
those purposes or any others. The company had complied with Principles 4.4 and 4.5 
and section 5(3) of the Act. The complaint was not well-founded. 


Bank discloses client's mortgage history to her ex-husband’s lawyer 


“He-said, she-said” cases can be devilishly difficult to adjudicate. In this one, 
fortunately, a paper trail largely supported what “she said”. 


If there’s a lesson for bank staff in this situation, it’s that, when dealing with 
lawyers, you had better make sure at the outset whose side they’re on. 


The facts 

While attending a court hearing regarding her support arrears action, the complainant 
had received copies of three documents entered into evidence by her ex-husband’s 
side: the deed for her home, a land registry office listing of mortgages registered 
against her home, and a mortgage transaction history. 


The complainant believed that the manager of financial services at her bank had given 
these documents, as well as other information about her financial affairs, to her ex- 
husband’s lawyer on a certain date. She also held that the manager had admitted as much 
to her and had asked her not to tell the court about his inappropriate disclosures. 


Her allegation to our Office was that the bank had disclosed her personal financial 
information to her ex-husband’s lawyer. 


With respect to the deed and the mortgage listing, our investigation determined that 
the bank manager would not have had access to these documents on the date in 
question. Moreover, such documents are publicly available at the land registry office, 
and evidence indicated that the lawyer had already obtained these two documents 
from that office when he visited the bank manager. 


However, with respect to the mortgage transaction history, documentary evidence 
established that the lawyer had prepared and sent a summons to the bank manager, 
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had then written to the manager to make an appointment for the date in question 
in order to review the documentation demanded on the summons, and had, on the 
day before the date in question, acknowledged receipt of a reply from the manager. 
Furthermore, the copy of the complainant’s mortgage transaction history that the 
lawyer submitted to the court had been printed from the bank manager’s computer 
and was dated the same day as his reply to the lawyer. 


The manager did not admit to printing the document, providing it to the lawyer, 
or asking the complainant not to reveal his disclosures. Nevertheless, he did admit 
that, at first contact, he had mistakenly assumed that the lawyer was acting on the 
complainant’s behalf. 


Conceding that the complainant’s mortgage transaction history had been disclosed to 
the complainant, the bank issued her an apology. © 


Our findings 

The deed of land and the mortgages registered against the complainant’s home were 
determined to be publicly available information obtainable through the land registry 
office. Such information could be disclosed without knowledge and consent, pursuant 
to section 7(3)(h.1) of the Act. In any case, it appeared that the lawyer had already 
gathered this information before approaching the bank. 


The mortgage transaction history, however, was determined to have been printed 
from the bank manager’s computer on the same date he had written to the lawyer. 
Our Office believed, and the bank agreed, that the document had been disclosed 


without the complainant’s consent. The complaint was well-founded. 
Select Settled Cases under P/PEDA 


In January 2004, the Office of the Privacy Commissioner introduced a new category 
of complaint disposition, “Settled during the course of the investigation”. A settled 
case is one in which, during the actual complaint investigation, the Office has helped 
negotiate a solution satisfactory to all parties, including the Office itself. Of the 379 
cases concluded in 2004, 152 (or 40 per cent) fell under the “settled” category. 
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The following are summaries of several representative settled cases. 


Laptop lapse by computer store 


When a computer store did not fix a complainant’s laptop within a certain time limit, 
it provided her a new one. Some time later, she was surprised to get a call from a 
complete stranger, telling her he had just bought a laptop containing her personal 
information. 


As it turned out, the store had repaired the complainant’s original computer, and an 
employee had put it up for resale without examining its contents. The store was able 
to retrieve the laptop and return it to the complainant. The company also significantly 
improved its safeguarding policy and practices. Notably, employees now have to 
not only ensure, but also document, that personal information is completely erased 
from the hard drives of all computers returned to any of the company’s stores across 
Canada. The company also agreed to implement similar safeguarding procedures for 
other electronic devices that it sells. 


Phone and e-mail procedures: One security concern leads to another 


Whenever customers pay their bills through the telecommunications company’s 
interactive voice response system, the system reads back the credit card number and 
expiry date that the customer entered via the telephone keypad. A complainant was 
concerned that anyone intercepting a cell phone call could obtain these numbers. But 
when he e-mailed to express this concern, the company’s e-mail reply repeated the 
account number and personal identification number that he had entered to gain access 
to the secure account information system. The complainant was now concerned that 
this sensitive personal information, too, could be available to anyone else who might 
gain access to the e-mail. 


The company reviewed its practices and agreed that it was not necessary to 
automatically reproduce in e-mail responses the personal data required for accessing 
the secure site. It has now ceased to include message threads in its e-mail responses 
to customers. As for the original concern, however, the company pointed out to the 
complainant that several payment options were available to customers and that, even 
if credit card numbers were no longer to be read back, customers who chose to pay 
bills by cell phone would still risk interception of the numbers as they were keyed in. 
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Insurance company fails to heed client's warning 


On two distinct occasions, a complainant had warned his insurance company that 
unauthorized persons might try to obtain information about life insurance policies he 
held on his nephews. Despite these warnings, and despite the company’s authentication 
and flagging procedures in place at the time, information was later disclosed to an 
unauthorized party against the complainant’s express wish. 


The complainant and the company reached a settlement. As a result of the complaint, 
the company has greatly improved its authentication and flagging policy and 
procedures and has incorporated the new policy in its training for customer service 
representatives. 


Transportation company eliminates excessive database information 


An employee of a national transportation company complained about lack of security 
of personal information in an automated crew management system. Specifically, he 
was concerned that unauthorized personnel, especially union representatives, could 
gain access to such employee information as date of birth, social insurance number 
(SIN), health information, wage rates, and vacation eligibility. 


In fact, it was not possible for union representatives to gain access to some of the 
information of concern to the complainant. Moreover, at the time of the complaint, 
the company had already identified date of birth and the SIN as privacy concerns and 
was in the process of adjusting its crew management system accordingly. In the end, 
the company agreed also to remove employees’ health information from the system. 


Personal information circulates on hundred-dollar bill 


When a complainant offered a $100 bill for a gasoline purchase, the service station 
attendant asked for identification. According to the complainant, the attendant then 
wrote his name and driver’s licence number on the bill itself, explaining the practice 
as “company policy” due to the high incidence of counterfeit bills. On reflection after 
the incident, the complainant worried that his personal information would thus be 
available to anyone handling the bill for as long as it remained in circulation. 


The company does make a policy of having station staff temporarily record 
identification for customers tendering $100 bills, but stipulates that the recording be 
done on separate tracking sheets, not on the bills themselves. Although the attendant 
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knew the correct procedures and did not admit to having written on the bill, the 
company took responsibility in the matter, apologized to the complainant, and reached 
a settlement with him. The company also reminded all its service station employees of 
the proper procedures for handling personal information. 


Pharmacy makes consent procedure more customer-friendly 


A complainant objected that his pharmacy was requiring him to sign a consent form 
before giving him his medication. It seemed to him that the form authorized overly 
broad disclosure practices, and he was concerned that his personal information might 
be disclosed for marketing purposes. He also worried that he would not be able to 
obtain the medications he needed if he refused to sign. 


In fact, the pharmacy chain does not disclose customers’ personal information to 
other organizations for marketing purposes. Nevertheless, in response to this and 
several other complaints about its consent form, the company decided to change 
the language of the form, making it simpler and easier for customers to understand. 
The company also implemented a new policy and practice whereby clients who are 
uncomfortable signing a consent form can provide oral consent to the company’s 
privacy practices, as explained to them by the pharmacist. 


Another pharmacy clarifies consent policy 


A customer alleged that, even after he had withdrawn his consent to collection, use 
and disclosure practices, his pharmacy had disclosed personal information to his 
doctor. He also complained that the pharmacy refused to fill his prescriptions because 
of his consent withdrawal. 


The pharmacy’s only record of the complainant’s withdrawal of consent was dated 
some time after the alleged disclosure. After recording the withdrawal, the pharmacy 
had indeed refused to fill the complainant’s prescriptions, but had explained to him 
at the time that it was company practice not to fill prescriptions for persons who had 
revoked consent to the collection, use, or disclosure of personal information within 
the patient’s circle of care. The company’s privacy literature, however, explained such 
practice only in general ways, indicating that withdrawal of consent could adversely 
affect “service”. The company agreed to amend its privacy policy to specify that 
prescriptions could not be filled unless consent was provided. 
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Insurance company welcomes complainant's suggestions about consent form 


An applicant for life insurance complained that the insurance company was requiring 
her to consent to overly broad collection, use, and disclosure practices. 


Our Office facilitated a teleconference with the complainant and the company. 
The company explained to her its actual practices, which were consistent with the 
Act. Though the complainant was satisfied with this explanation, the company 
acknowledged that she had raised a number of important issues about the precision 
and clarity of its consent language — issues it was taking into account in a current 
review. The company agreed to send the complainant a copy of its revised form and 
invited her to make further comments, to be considered in subsequent reviews. 


An unappreciated birthday announcement 


Anemployee ofa foreign airline’s Canadian office complained when a secretary e-mailed 
his date of birth to fellow employees, despite his previously expressed objection to the 
local tradition of announcing birthdays. He also alleged that the airline had disclosed 
his home address and telephone number on lists provided to employees having no need 
to know such information, and that these lists were not properly safeguarded. 


At the suggestion of our Office, airline officials met with the complainant to address 
the issues he had raised. In the end, the airline resolved the issues to the complainant’s 
satisfaction — notably, by ceasing the practice of announcing birthdays and by taking 
measures to safeguard and limit access to documents holding employees’ personal 
information. The airline also held privacy briefing sessions with management and 
administrative staff and posted a privacy notice on an internal bulletin board accessible 
to all employees. 


Department store neglects to identify itself as source of mail-out 


Two individuals complained after receiving a mail solicitation ostensibly from a credit 
monitoring company. Though appearing to have been sent from the company itself, the 
solicitation indicated an association with a major department store chain with which 
both complainants held accounts. They both assumed that the chain had given their 
personal information to the credit monitoring company without their consent. In one 
case, the complainant had expressly withdrawn consent for the chain to use his personal 
information for any purpose other than directly conducting business with him. 
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In fact, the chain had not given personal information to the company. Rather, it had 
itself had the mail-out notice prepared and sent out, but under the other company’s 
name. The chain’s published policy is to rely on opt-out consent for disclosures of 
customer information to affiliated companies of its own “brand”, but it does not 
disclose to non-affiliated third parties such as the credit monitoring company. In the 
case of the complainant who had previously withdrawn consent, the chain explained 
the mail-out as the result of a normal administrative delay in processing his opt-out 
request. 


The chain agreed, however, that it had done a poor job in the marketing campaign 
and should have clearly indicated that it was acting on the other company’s behalf. It 
also apologized to the complainants, agreed to revise its account application policy to 
allow new customers to opt-out at the time of enrolment, and undertook a review of 
its suppression mechanisms to ensure consistency of the opt-out process across all its 
companies. 


Non-consensual disclosures to a union 


Several employees complained that a transportation company had forwarded a list of 
participants in its voluntary separation program to the employees’ union without their 


knowledge and consent. The list included the employees’ SINs. 


Admitting its mistake, the company changed the application form for severance 
packages to exclude the requirement for the SIN and to include a statement asking 
applicants to consent to the release of their personal information to the union. 


Two cases of envelope mix-ups 


In one case, a complainant had received a student loan notice from her bank — 
about someone else’s loan, not hers. She worried that this other person might be 
in possession of the same personal information about her as she had received about 
him — specifically, name, address, SIN, loan number, and loan amount. The mix-up 
had been the result of simple human error in filling envelopes. No other persons in 
the complainant’s mailing group had received a wrong notice, and the person whose 
information she had received had not received hers, since he had moved and not left a 
forwarding address. The bank reached a settlement with the complainant and advised 
its student centre staff to exercise greater diligence in mailing material to customers. 
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In the other case, a complainant had received another person’s airline ticket in the mail, 
and that other person had received that of the complainant. The tickets contained 
personal information in the form of travel itinerary, home address, and telephone 
number. This mix-up was also the result of human error, in that an airline employee 
had inadvertently reversed the tickets and envelopes for two phone ticket purchases. 
The airline apologized to the complainant and reached a settlement with him. It has 
also reminded its employee to exercise due diligence and care in sending material out 
to customers. 


SINs on display: An overly revealing envelope window 


A pension fund administrator complained that transfer documents he regularly 
received from a certain bank displayed clients’ SINs in the window of the envelopes. 
Readily acknowledging the problem, the bank instituted a new process whereby 
both the SIN and the account number were moved from the address portion of the 
document to an area not visible through the envelope window. 


Collection agency corrects inaccurate information 


A complainant had been having difficulty securing credit because of inaccurate 
information held by a collection agency. He had paid off a debt several years earlier, 
but the agency had not reported the payment to the credit bureaus. After several 
unsuccessful attempts through his lawyer to have the information corrected, the 
complainant approached our Office. 


The collection agency had no record of the lawyer’s letters. However, after receiving 
a notice from our Office and yet another letter from the lawyer, the agency looked 
into the complainant’s file, confirmed the debt payoff, and notified the credit bureaus, 
which amended the complainant’s credit files accordingly. 


Car dealership refuses credit on erroneous information 


A complainant knew her credit rating was good. When a car dealership turned down the 
credit application she had cosigned with her son, she wrote the company to ask for the 
information on which the credit decision had been based.’ Two months later, she wrote 
again. Still having received no response after three months, she filed her complaint. 


As it turned out, the decision had been based not on her own credit rating, but on her 
son’s. The company had not responded to her access requests because it was unsure 
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how to do so without disclosing the son’s personal information. At our suggestion, the 
complainant wrote the company another letter, signed by both her and her son and 
stating that they consented to the disclosure of information about themselves to each 
other. The company finally responded, indicating that the credit application had been 
declined because of a bankruptcy entry on the son’s credit report. The complainant 
wrote the company again to advise that the report was in error — the son had not in 
fact declared bankruptcy, but rather had made a proposal with his creditors and had 
satisfied its terms more than a year earlier. The company replied that it would use a 
current credit report for any future application. The complainant was satisfied just to 
finally have a response from the company. 


Meanwhile, the son had managed to lease a car from another dealership under the 
same brand. In the complainant’s words, someone at that dealership “clearly did know 
how to read the credit information.” 


Companies Getting Their Act Together 


A lending institution 


A woman complained that a lending institution had disclosed information about her 
delinquent account to her uncle without her consent. 


The complaint had merit, and the institution adjusted the complainant’s outstanding 
account and agreed to send her a letter of apology. During the investigation, our 
Office noted that the organization had no privacy policies or practices in place. At our 
urging, it struck a privacy committee, instituted privacy training for employees, and 
reminded staff to limit the amount of information disclosed in recovering debts. 


A trucking company 


A former employee alleged that a small, family-owned interprovincial trucking 
company had disclosed personal information to a creditor without his consent. 


There was no evidence to support the allegation, and it came to light that the 
complainant himself had provided some of the information to the creditor. 
Nevertheless, our investigation had the effect of educating the company about its 
obligations under the Act. The company subsequently implemented a written privacy 
policy, appointed a privacy officer, reviewed its practices regarding employee personal 
information, and took steps to train employees in proper information handling. 
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Incidents under PIPEDA 


Over and above individual complaints, incident investigations are conducted into 
matters of improper collection, use or disclosure of personal information that come to 
the attention of our Office from various sources, including the media, and directly from 
organizations themselves. They often highlight a systemic issue, or an unrecognized 
privacy breach that needs to be fixed as soon as possible. Usually, victims are not 
identified and a formal written complaint has not been filed with the Office. 


Last year, the Office completed six incident investigations. Three cases of interest are 
described below. 


Disclosure of credit reports to fraudster 


In March 2004, a credit reporting agency issued a statement that, as a result of a 
security breach, the credit reports of some 1400 consumers had been disclosed to 
criminals posing as legitimate credit grantors. The media picked up the story. 


The agency’s security staff discovered the breach and notified the RCMP, which 


launched an investigation. It appeared that a single individual committed the breach, 
and had not been caught as of May 2004. 


The agency confirmed that 1398 consumers were affected — 1145 in British Columbia, 
163 in Ontario, and 90 in Alberta. 


The information disclosed in each credit report was the consumer’s name, address, 
previous address (if available), date of birth, and payment history, as well as creditor 
names and account numbers, public record items, and collection activity. The agency 
confirmed that the disclosed information did not include social insurance numbers or 
bank account particulars. 


By way of corrective action, the agency: 


e Notified all affected individuals by registered mail; 

e Encouraged them to call the agency and review the contents of their credit files; 

e Placed an alert message reading “Lost or stolen identification” on their credit files 
so that creditors would be prompted to ask for additional proof of identity; 

e On being contacted by an affected individual, requested that the other major 
credit reporting agency place a similar message on its credit file for that individual, 
and 
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¢ Offered the affected individuals a free one-year subscription to a credit monitoring 
service (most accepted this offer). 


To address the security problem, the agency put certain fixes in place on its systems. 
These fixes appear to be effective, in that the same perpetrator attempted to access 
credit files in the same way a second time, but was blocked. 


Since the incident, there have been a small number of fraud attempts involving the 
disclosed information, but in each case the alerts prevented the fraud. 


Joint federal/provincial investigation of misdirected medical information 


In July 2004, a newspaper article reported that a married couple had been receiving 
faxes from various sources containing other parties’ personal health information. The 
couple alleged that they had so notified some of the sources in question, but had 
continued to receive more of the same. 


The Office of the Information and Privacy Commissioner for Alberta originally 
investigated this incident. That Office determined that, though provincial privacy 
legislation applied to some of the information transmitted in the faxes, it also 
appeared to fall under federal jurisdiction under PIPEDA. The Office of the Privacy 
Commissioner of Canada therefore undertook its own investigation in concert with 


the Alberta office. 


The couple in question manages an apartment building. The fax line they use in 
managing the property has a telephone number similar to that of a health care 
provider, but with two of the digits reversed. The couple received ten faxes misdialed 
to their number. 


Our Office concerned itself with seven of the ten errant faxes (the other three fell 
under provincial jurisdiction). Two of the seven were found not to contain personal 
information. For the remaining five, the sources were determined to be three separate 
and distinct companies. 


The first is a company that owns and operates medical laboratories. The fax it 
misdirected to the couple’s number contained the personal information of an individual 
who had undergone medical testing by the company. The information included the 
person’s name, age, height, smoking habits, and patient number, as well as a diagnosis 
and specific medical test results. 
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In its own internal investigation, this company was unable to determine which of its 
employees had keyed in the erroneous telephone number, but it did manage to narrow 
the possibilities down to five. All five employees were aware of the confidential nature 
of the medical records and the need to ensure against disclosure, and all five had 
signed a confidentiality oath at the time they were hired, but had not been required 
to renew the oath since then. 


For regularly used fax numbers, this company has now equipped its computers with an 
electronic automated fax function which checks numbers entered into the system for 
accuracy before use. For numbers used one time or infrequently (i.e., not programmed 
into the automated system), the company has provided its employees with a set of 
instructions to ensure accuracy of transmission. At the Office’s request, the company 
also undertook to revise its policies and procedures to ensure full compliance with the 


provincial Health Information Act and PIPEDA. 


The second source of the errant faxes is a waste disposal company whose employees 
are required to have annual medical examinations. This company misdirected three 
faxes, one of which predated the full implementation of PIPEDA. The other two 
were completed health information forms about two employees who had just had the 
annual examination. However, it was not the company that had misdirected the faxes, 
but rather the employees themselves, each misdialing the number in the same way. 
For privacy reasons, it is the company’s practice to have its employees send in their 
own health forms. 


This company has now put the correct fax number on speed dial so that its employees 
may continue to send in their own health forms with much less risk of inadvertent 
disclosure. The company also has a privacy officer and acceptable privacy policies in 
place. 


The third company involved is a medical consulting firm whose doctors review and 
assess new medical consultants’ reports on patients. The single misdirected fax in this 
instance contained such a report that one of the company’s doctors had reviewed. 
The doctor in question had not sent the fax himself, and the company was unable 
to determine who had. The faxed report contained the patient’s name, age, and 
occupation, as well as a detailed medical history relating to an injury she had sustained 
in a motor vehicle accident. It also contained information about her children. 


When the couple had called to notify this company of the errant fax, a company 
employee had instructed them to destroy it. In hindsight, the company realized that 
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this instruction was inappropriate, in that the employee had had no way of confirming 
that the document was destroyed or whether it was destroyed by a suitable method. 
The company has arranged to have errant faxes picked up by courier in future. It 
has also taken procedural measures to have all facsimile numbers verified before 
transmission and to have any future incidents reported to management. 


At our Office’s request, this company has informed the patient in question of the 
disclosure of her personal information, has appointed a privacy officer and has sent 
the Office copies of its revised fax transmission procedures and privacy policy. 


The Office made the following recommendations to the first and third of the 
companies: 


(1) That the companies implement and follow the Office’s recommendations on 
the transmission of faxes, as set out in the fact sheet entitled “Faxing Personal 
Information’; 


(2) That the companies implement measures to ensure that faxes are recovered if 
reported as misdirected; 


(3) That the companies notify individuals when their personal information has been 
inadvertently disclosed as a result of a misdirected fax; and 


(4) That the companies have their employees sign confidentiality/privacy agreements, 
update such agreements yearly, and review company privacy policies. 


Credit card receipts blowing in the wind 


In August 2004, a newspaper reported that two women had observed credit card 
receipts blowing about in their neighbourhood and had traced the source to a local 
gas station, where old receipts had been placed in a dumpster. 


The station owner admitted to having disposed of various receipts from 2002 in the 
dumpster, but claimed he had been unaware of the privacy implications of this action. 
He said that the receipts had been contained in boxes, placed in the middle of the 
dumpster, and covered by other garbage. He suspected that neighbourhood children 
had climbed into the dumpster and opened the boxes out of curiosity, thereby exposing 
the receipts to the elements. 


He stated that, on being informed of the problem by a reporter on the day in question, 
he had taken immediate action to gather up the loose receipts, clear the dumpster of 
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those remaining, and have all the receipts shredded. Though he maintained that he 
and his employees had been able to find few loose receipts to gather, our investigation 
established that the two original women witnesses had previously gathered three bags 
and one boxful of the loose receipts in vicinity of the gas station. 


The witnesses turned in the receipts they had gathered to our investigator. A sampling 
of 1,897 of these documents indicated that most were debit card receipts with no 
identifiable personal information, and many others were credit card receipts showing a 
past expiry date. However, a further 151 credit card receipts showed valid (unexpired) 
account numbers, 16 showed valid account numbers as well as handwritten licence 
plate numbers, three showed valid account numbers as well as handwritten driver's 
licence numbers, and one showed both a driver’s licence number and a plate number. 


The owner gave assurances that he was now aware of his responsibilities under the 
Act and had initiated policies to keep all receipts only for the required six months and 
then have them destroyed securely by means of shredding. 


The owner leases the station from an energy company. In an interview, the company’s 
district manager initially took the position that the company’s privacy policy did not 
apply to its leased establishments. He later conceded, however, that leaseholders were 
generally expected to adhere to the company’s policies and procedures and that the 
company did customarily provide training and information sessions for leaseholders. 
But neither he nor the station owner could recall any such information session about 
privacy policy. The district manager indicated that the company would provide privacy 
information sessions for leaseholders in the near future, and that he himself would 
review privacy policies in his monthly meetings with the leaseholders in his district. 


Our Office made two recommendations: 


(1) That the company ensure that privacy policies are in place at all of its leased 
locations and examine the option of putting requirement to that effect into its 
lease agreements; and 


(2) That the privacy policies for the company’s gas stations contain procedures for 
the proper retention, safeguarding, and disposal of all personal information 
collected. 
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Following Up on PIPEDA Case Investigations 


In 2004, we introduced a formal procedure of systematic follow-ups to complaint 
investigations under PIPEDA. As a matter of course, the Investigations and Inquiries 
Branch monitors the progress of organizations in implementing both commitments 
they make during complaint investigations and recommendations that the Office 
issues to them in letters of findings. We ask organizations to report on their intentions 
and their progress in meeting these commitments and recommendations. We also ask 
them to provide documentary evidence of implementation. 


The purpose of follow-up is two-fold. First, it reinforces and clarifies the Office’s 
expectations that organizations take remedial measures in response to specific 
problems identified in complaint investigations. Second, it provides a reliable ongoing 
record of organizations’ compliance with PIPEDA. 


In late 2004 and early 2005, in a special exercise to establish a solid basis for such a 
record, our Investigation and Inquiries Branch applied the new follow-up procedure 
to past cases in which organizations’ responses to recommendations or commitments 
remained unverified. Specifically, Branch investigators completed follow-ups on over 50 
significant unverified cases concluded between January 1, 2001 and November 1, 2004, 
and involving the federally regulated organizations that had been subject to PIPEDA 
from the beginning (banks, telecommunications companies, national transportation 
companies, etc.).? The subject cases were those in which the Office had identified 
privacy problems and expected the organizations to take specified remedial action in 
response either to commitments they had made at our suggestion during investigations 
or to recommendations we had later made to them in letters of findings.* 


Through day-to-day dealings, the Office had already formed a good sense of how 
well respondent organizations had been co-operating in investigations and following 
through on commitments and recommendations. However, when we analyzed the 
results of these follow-ups in conjunction with case results already known, we were 
able to see a fuller, clearer and statistically representative picture of the cumulative 
effect of our complaint investigations on compliance with PIPEDA.’ 


> The analysis did not include cases involving provincially regulated companies, since such organizations 
had been subject to the Act for less than a year (January 1, 2004). 


* In the interest of time and efficiency, the many routine cases of (largely resolved) complaints under the access 
provisions of the Act were also excluded from consideration in both the follow-ups and the analysis. 


> The analysis accounts for approximately 75 per cent of applicable cases concluded during the period in 
question. 
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Most notably, we determined that, of the verified cases in which our Office expected 
a remedial response, federally-regulated organizations had fully implemented our 
recommendations arising out of the investigation of a complaint about nine times out 
of ten. We also determined that 67 per cent of these satisfactory responses involved 
some degree of systemic improvement in the organizations themselves. In other words, 
in approximately two of every three cases, the organization’s remedial response had 
gone beyond the mere settling of a complainant’s immediate concern and had led the 
organization to establish positive substantive change in its information management 
systems relating to privacy policy, procedures and practices. 


The following are just a few examples of systemic improvements implemented 
by respondent organizations in the first four years of PIPEDA arising from our 
recommendations: 


e A bank instituted an alternative process to accommodate deposit account 
applicants who refused to consent to a credit check. 


e Another bank, on our recommendation, collaborated with credit reporting 
agencies to develop understandable, consumer-friendly formats for credit 
information. 


e Several organizations acknowledged that the use of social insurance numbers 
(SINs) is a privacy-sensitive issue and changed their policies and practices 
accordingly. One bank, for example, stopped requiring customers to use a 
SIN in activating credit cards. Another bank amended its loan application 
form to indicate that provision of the SIN is optional, and stressed to its 
employees that the SIN is not required for processing loan applications. 


e Through extensive consultation with our Office, a bank whose privacy 
literature we originally considered to be the least compliant among all the 
banks greatly improved its consent language and practices, particularly as they 
related to use and disclosure of personal information for secondary marketing 
purposes. We now regard this bank’s privacy literature as among the best. 


e Another bank followed our recommendation to improve the security of 
computers at its kiosk branches. 


e Another bank discontinued its practice of issuing unsolicited credit cards and 
creating credit card accounts without consent. 


e A lending institution struck a privacy committee, instituted privacy training, 
and instructed staff on limiting the amounts of information they disclose in 
recovering debts. 
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e A telecommunications company stopped using customers’ telephone records 
to obtain information about other individuals. | 


e In a case about the posting of employees’ sales records, another 
telecommunications company told its sales managers about appropriate uses 
and disclosures of such information, updated its employee training program 
accordingly, and revised its recruitment and selection process to inform 
employees of the company’s intended uses of their personal information. 


e A broadcaster developed and distributed a policy on its use of security cameras 
and access controls. 


e An airline vastly improved its privacy policy and practices related to its 
rewards program. 


e A transportation-related management corporation fully implemented 
our recommendations concerning its sick leave policy. Most notably, the 
corporation no longer requires its employees to include specific diagnoses on 
their medical certificates. 


e Inclose consultation with our Office, a market research company implemented 
our recommendations regarding its consumer surveys, particularly relating to 
identification of purposes, and consent to third-party disclosures. The result 
is a much more transparent and privacy-compliant survey form and process. 


e A rewards program not only improved its communications materials as we 
recommended, but also made other privacy-related improvements beyond 
our recommendations. 


Though not yet complete, the record already abounds with evidence that federally 
regulated organizations have largely taken their responsibilities under PIPEDA very 
seriously. They have generally cooperated with our Office in complaint investigations 
and have tended to remedy, in substantive and permanent ways, the problems that we 
identify. Similarly, the record clearly shows that complaint investigations in themselves 
greatly increased overall compliance with the Act by respondent organizations. 
Almost half of satisfactory responses by organizations have occurred, not pursuant 
to recommendations in a letter of findings, but rather during or as a direct result of 
the complaint investigation itself. In other words, our Office’s investigators have been 
the main instruments of problem solving in almost half the cases of a satisfactory 


response by an organization. 
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Our rate of success shows not only the effectiveness of our investigative function, but 
also the continuing efficacy of the Commissioner’s ombudsman role. Although the 
record appears sound, we are taking measures to improve it. We believe that our new 
formal procedure of systematic follow-up is one measure in particular that will enable 
us to bring about an even higher rate of compliance with PIPEDA. 
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Strengthening the Audit Function 


ection 18(1) of PIPEDA allows the Commissioner to audit the personal 
G ies management practices of an organization if the Commissioner 
has reasonable grounds to believe that the organization is contravening the fair 
information practices set out in the Act and Schedule. To date, we have conducted no 
audits under PIPEDA. However, now that PIPEDA is fully in force and organizations 
have had time to adapt to it, our Office has recently begun actions to use the audit 


power where warranted. 


In March 2005, the Branch name changed from “Privacy Practices and Reviews” to 
“Audit and Review”. This signals an important transformation. Our Office intends to 
make greater use of audits, and they will become an important tool in carrying out our 


mandate under both the Privacy Act and PIPEDA. 


The Audit and Review Branch’s goal is to conduct independent and objective audits 
and reviews of personal information management systems for the purpose of promoting 
compliance with applicable legislation, policies and standards and improving privacy 
practices and accountability. 


The year 2004 marks the beginning of efforts to rebuild and strengthen audit and 
review functions. Audits have not yet been used to their potential as among the key 
tools for addressing the many privacy risks. The systemic risks are wide ranging, 
including inadequate data security, identity theft, inappropriate gathering, retention 
and use of personal information, and failure to act when privacy breaches occur. 
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It will take time to build the capacity to undertake sufficient and appropriate audits. 
The Branch now has only four auditors to undertake both public and private sector 
audits. The scope of the “audit universe” is over 150 federal departments and agencies 
subject to the Privacy Act, and thousands of commercial organizations in Canada 
subject to PIPEDA. 


Steps our Office will take to strengthen the audit function include: 


e Completing an external review of audit methods and practices; 

e Setting a Branch goal and articulating team values; 

e Undertaking a process to develop a longer term audit strategy and plan in 
view of privacy risks and issues; 

e Building a business case to submit to Treasury Board of Canada to obtain 
further funding for audit and review; 

e Raising awareness with Parliamentary committees about the value of privacy 
audits; 

e Initiating a project to determine and test a process for establishing “reasonable 
grounds” to select subjects for audits under PIPEDA. The criteria and process 
will be published on our Web site during the next fiscal year, and we will 
welcome comments; 

e Initiating a project to develop a self-assessment tool to help organizations 
ensure compliance with PIPEDA, and to promote good personal information 
management practices. We want organizations to understand that good privacy 
makes for good business and that they need a sound privacy management 
framework. ‘This would include internal auditing of systems and practices for 
meeting privacy obligations. The self-assessment tool (audit program) will 
also be published on our Web site; and 

e Undertaking a survey of private industry about the use of radio frequency 


identification devices (RFIDs). 


Keeping Watch on Radio Frequency Identification 


We continue to monitor advances in RFID technology. In our view, companies should 
establish policies and standards before they implement RFID technology, not after 
the fact. Any use of RFIDs must comply with PIPEDA. Furthermore, we want to 
know the role of RFID applications in data aggregation and mining activities, since 
these depend on obtaining ever-increasing amounts of detail about individuals and 
what they buy or rent. 
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We plan to send letters to selected corporations in Canada that might be introducing 
RFIDs, to better understand the emerging uses of RFID. Our primary interest is 
in learning how RFID might be used to link personal information with products 
and services. We want to know if the technology will be used to identify or track 
individuals. We also want to know if companies will do privacy impact assessments or 
threat/risk assessments when developing and implementing RFID applications, and 
how employees and customers would learn about the presence and use of RFIDs. 


The survey results will appear in next year’s Annual Report. We will not disclose 


proprietary business information. We will continue monitoring developments in 
RFID technology to see where guidance on privacy issues is necessary. 
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PIPEDA Applications 


nder section 14 of PIPEDA, an individual complainant has a right, following 
UJ the Commissioner's investigation and report, to apply to the Federal Court for a 
hearing in respect of any matter referred to in the Commissioner's report. These 
matters must be among those identified in section 14. Section 14 also allows the 
Commissioner to apply directly to the Federal Court in respect of a Commissioner- 


initiated complaint. 


Section 15 also allows the Commissioner to apply directly to the court for a hearing 
in respect of any matter covered by section 14 (with the consent of the complainant); 
appear before the Court on behalf of any complainant who has applied for a hearing 
under section 14; or, with the permission of the Court, appear as a party to any section 
14 hearing not initiated by the Commissioner. 


Between January 1, 2001 and December 31, 2004, 35 applications were filed in Federal 
Court in relation to PIPEDA. Fifteen of those were filed in 2004. This means that the 
number of applications in 2004 alone almost equaled all other applications filed since 
PIPEDA came into force until the start of 2004 — a huge annual increase. Following 
is a list of all of the PIPEDA applications filed in the Federal Court in 2004: 


e Karen and Daniel Edwards v. Canadian Imperial Bank of Commerce (Federal 
Court No. T-35-04), Discontinued November 2, 2004 

e Keith Vanderbeke v. Royal Bank of Canada (Federal Court No. T-222-04) 

e Ron Gass v. NAV Canada (Federal Court No. T-821-04), Dismissed July 
2004 (by consent) 
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e Pierre Jean Trudeau v. Banque TD Canada Trust (Federal Court No. T-851- 
04), Dismissed February 23, 2005 (for delay) 

e Bradley Nazaruk and United Transportation Union, Local 691 v. Canadian 
National Railways (Federal Court No. T-948-04), Discontinued July 8, 2005 

e Janice Morgan v. Alta Flights (Charters) Inc. (Federal Court No. T-1066- 
04) 

e Jan David Kosher v. Canadian Imperial Bank of Commerce (Federal Court 
No. T-1143-04) 

e 3web Corporation v. Llano Gorman (Federal Court No. T-1603-04), 
Discontinued June 2005 

e Paul Wansink and Telecommunications Workers Union v. ‘Telus 
Communications Inc. (Federal Court No. T-1862-04), Consolidated with 
Federal Court No. T-1865-04, December 31, 2004 

e Henry Fenske and ‘Telecommunications Workers Union v. Telus 
Communications Inc. (Federal Court No. T-1863-04), Consolidated with 
Federal Court No. T-1865-04, December 31, 2004 

e Paul Bernat and Telecommunications Workers Union v. Telus (Federal 
Court No. T-1864-04), Consolidated with Federal Court No. T-1865-04 31, 
December 2004 

e Randy Turner and Telecommunications Workers Union v. Telus (Federal 
Court No. T-1865-04) 

e John Testa and Brenda Marie Testa v. Citibank (Federal Court No. T-2135- 
04), Dismissed June 15, 2005 (settlement reached at pre-trial conference) 

e Richard Breithaupt and Peggy Fournier v. Hali MacFarland and Calm Air 
International Itd. (Federal Court No. T-2061-04) 


Important Decisions 


Following are important decisions made in 2004 on the application of PIPEDA: 


Mathew Englander v. Telus Communications Inc. and Privacy Commissioner of Canada 
Federal Court File No. T-1717-01 and Federal Court of Appeal File No. A-388-03 


Mr. Englander argued that Telus uses and discloses customers’ names, addresses and 
telephone numbers in its white pages directories and otherwise, without customers’ 
knowledge and consent. He also claimed that Telus inappropriately charges customers 
for choosing to have their telephone number “non-published”. He felt that these 


actions by Telus contravene sections 5(1) and (3) of PIPEDA, as well as several clauses 
of Schedule 1. 
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On the question of consent, the former Commissioner found that the company 
did obtain valid consent through implication and complied with the regulations 
regarding publicly available information. He focused on the company’s questioning 
of customers about how their information should appear in the white-pages directory 
and determined that the question itself implied the eventual appearance of the 
information in publicly available directories. Since information subsequently published 
in other formats merely reflects what is published in the white pages directory, it too 
is considered publicly available information for purposes of the regulations under the 
Act, and may be collected, used or disclosed without consent. 


As to charging fees for the non-publication of customers’ information, the 
Commissioner referred to CRTC Telecom Order 98-109, which states that 
telecommunications companies may charge no more than $2.00 per month to provide 
non-published telephone service. He determined that the company did have the 
authority to charge its monthly fee of $2.00 for non-publication, and that doing so 
was not unreasonable. 


Mr. Englander filed the very first Federal Court application under section 14 of PIPEDA 
after the former Commissioner released his findings. The former Commissioner was 
not a party to these proceedings. Ultimately, the Federal Court concluded that Mr. 
Englander had failed to convince the court that his application was well-founded, and 
dismissed the application with costs to the Respondent. 


Mr. Englander filed an appeal in the Federal Court of Appeal. The current Privacy 


Commissioner was granted leave to intervene in the appeal. 


The Court heard the appeal on October 7, 2004. The decision, released on November 
17,2004, allowed the appeal in part on the basis that Telus did not have proper informed 
consent from first-time customers to use their personal information in directories; 
consent is not informed when the person allegedly giving it is not aware at the time of 
the possibility of opting-out. Information given to customers subsequently may factor 
into an evaluation of compliance with the “openness” principle, but comes too late for 
consent. The Court emphasized that consent in this situation was particularly critical 
because it was the gateway to information becoming publicly available. 


The Court’s February 9, 2005, decision declared that in light of Telus’ undertaking 
to change its practices to conform with PIPEDA, there was no need to compel Telus 
to make those changes. The judgment states that “the Court is satisfied that it is 
sufficient in the case at bar to declare that Telus has infringed section 5 of the Personal 
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Information Protection and Electronic Documents Act and that there is no need for the 
issuance of a mandatory injunction.” 


Erwin Eastmond v. Canadian Pacific Railway and Privacy Commissioner of Canada 
Federal Court File No. T-309-03 


Mr. Eastmond complained that his employer was collecting the personal information 
of employees without their consent. Specifically, he was concerned that digital video 
recording cameras installed at the company yard could collect personal information 
of employees. 


The former Privacy Commissioner applied section 5(3) of PIPEDA and explained that 
when using this section one must consider both the appropriateness of the organization's 
purposes for collection and the circumstances surrounding those purposes. To that end, 
he used a four-point test for assessing reasonableness: (1) Is the measure demonstrably 
necessary to meet a specific need; (2) Is it likely to be effective in meeting that need; 
(3) Is the loss of privacy proportional to the benefit gained; and (4) Is there a less 
privacy-invasive way of achieving the same end? The former Commissioner found that 
a reasonable person would not consider these circumstances to warrant such an intrusive 
measure as digital video surveillance. He concluded that the company’s use of this type 
of surveillance for their stated purposes was not appropriate and that the company had 
contravened section 5(3) of PIPEDA. 


In February 2003, Mr. Eastmond filed an application, as permitted by section 14 of 
PIPEDA. He sought an order confirming the finding of the former Commissioner 
as well as various related orders. He also requested a certified copy of the former 
Commissioner’s record of investigation. 


The former Commissioner objected to this request for materials, and the Court 
agreed in June 2003 that the Federal Court Rules do not allow an Applicant, in a 
section 14 application under PIPEDA, to request material in the possession of the 
Privacy Commissioner. 


The Interim Privacy Commissioner was also added as a party pursuant to section 
15(c) of PIPEDA, but took no position as to the appropriate outcome on the facts, 
instead arguing on points of law that the Court should accord some deference to the 
expertise of the Commissioner and should adopt the four-point test to determine the 
appropriateness of the collection of the information by CP Rail. A supplementary 
factum was filed in December 2003 addressing the jurisdiction over the issues of 
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both the Commissioner and the Court, notwithstanding that these issues arose in a 
collective bargaining situation. The supplementary factum suggested that concurrent 
jurisdiction existed in this situation. 


The application was heard in April 2004. On June 11, 2004, the court released its 
decision. The Court found that the Privacy Commissioner did have jurisdiction, that 
the essence of this dispute did not arise from the collective agreement, and that it was 
not Parliament's intention to exclude unionized workers from the scope of PIPEDA. 


The Court also concluded that although this was a proceeding de novo, the Commissioner 
was entitled to a degree of deference in light of the Commissioner’s expertise. 


Finally, the Court adopted the four-point test for section 5(3), with the caveat that the 
specific factors considered in this case might not be appropriate in all cases. Using that 
test, the Court concluded that a reasonable person would consider the organization’s 
purposes for collecting the images through the medium of a digital video camera to be 
appropriate in the circumstances. CP Rail therefore had not contravened PIPEDA. 


Cases in the Courts 
The following cases are of particular interest in the ongoing interpretation of PIPEDA: 


Keith Vanderbeke v. Royal Bank of Canada 
Federal Court File No. T-222-04 


Mr. Vanderbeke had previously made a complaint about Royal Bank of Canada’s 
(RBC) treatment of his personal information. This related complaint alleged systemic 
improprieties in RBC’s record keeping procedures, specifically that the bank was not 
“properly” retaining mortgage renewal acknowledgement letters for its clients. The 
bank explained that they do not keep a copy of the acknowledgement letters sent 
to customers as the letters contain information that is available in other documents. 
Reviewing the complaint, the Assistant Privacy Commissioner considered that 
PIPEDA provides individuals with a right of access to personal information itself, but 
not necessarily the specific documents containing that information. Accordingly, she 
considered the complaint not well-founded. 


Mr. Vanderbeke filed an application, as permitted by section 14 of PIPEDA, on 
January 29, 2004. RBC made a motion for an order to strike the application, but was 
not successful. 
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An order dated July 5, 2004, stipulated that Mr. Vanderbeke pay security monies into 
Court before filing his affidavit. This caused delay in the proceedings until February 
23, 2005. To date, the Commissioner has not become involved in this application, but 
is monitoring developments closely. 


Janice Morgan v. Alta Flights (Charters) Inc. and Privacy Commissioner of Canada 
Federal Court File No. T-1066-04 and Federal Court of Appeal File No. A-184-05 


Ms. Morgan, a former employee of Alta Flights, complained that her employer tried 
to collect and use her personal information without her knowledge and consent. 
Specifically, she alleged that a manager had taped a digital recorder to the underside of 
a table in a smoking room accessible to employees in an attempt to collect their personal 
information. The company acknowledged that the manager had attempted to collect 
employee personal information without the knowledge or consent of those employees. 


The investigation determined that since there was no evidence of a recording, there 
was no evidence that the complainant’s personal information had been collected or 
used. The Assistant Privacy Commissioner concluded that the company was not in 
contravention of PIPEDA and, accordingly, the complaint was not well-founded. 
However, she cautioned that the company should not interpret her finding as an 
approval of what the manager had attempted to do. 


Ms. Morgan filed an application in Federal Court, as permitted by section 14 of 
PIPEDA, on May 26, 2004. The original application incorrectly named the Privacy 
Commissioner as a respondent. On September 14, 2004, the Court granted the 
Privacy Commissioner’s motion to be struck as a respondent and added as a party to 


the application, as permitted by section 15(c) of PIPEDA. 


At trial, the Privacy Commissioner made representations concerning five matters: (1) 
jurisdiction of PIPEDA over the subject matter notwithstanding a Canada Labour Code 
unjust dismissal complaint in respect of the same issue; (2) the appropriate standard 
of review and deference to be accorded the Privacy Commissioner’s findings; (3) the 
appropriate interpretation of section 7(1)(b); (4) whether an attempted collection 
constituted a collection; and (v) whether there is a common law jurisdiction to grant 


remedies not authorized by PIPEDA. 


The court heard the application on March 15, 2005. Like the Assistant Privacy 
Commissioner, the Court concluded that since there was no evidence that any 
conversations were recorded, the company did not actually manage to collect and/or 
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use any personal information. There was no violation of PIPEDA since an attempt to 
breach the Ac¢ does not exist as a violation of PIPEDAZ. 


On the issue of whether to give deference to the Privacy Commissioner’s decision, 
the Court concluded that it may rely on the decision of the Privacy Commissioner or 
certain parts of it in arriving at its determination, but it is not bound to do so. When 
exercising its discretion de novo, the Court will give less deference to the decision 
of the Privacy Commissioner than it would otherwise. However, some regard is 
warranted about the factors taken into consideration by the Privacy Commissioner 
in balancing the privacy interests of the complainant and the employer's legitimate 
interest in protecting its employees and property. 


Ms. Morgan filed an appeal of the decision in April 2005. 


Paul Wansink and Telecommunications Workers Union v. Telus and Privacy Commissioner of Canada 
Federal Court File No. T-1862-04 

Henry Fenske and Telecommunications Workers Union v. Telus and Privacy Commissioner of Canada 
Federal Court File No. T-1863-04 

Paul Bernat and Telecommunications Workers Union v. Telus and Privacy Commissioner of Canada 
Federal Court File No. T-1864-04 

Randy Turner and Telecommunications Workers Union v. Telus and Privacy Commissioner of Canada 
Federal Court File No. T-2222-03 


The Applicants complained to the Privacy Commissioner that their employer, Telus 
Communications Inc., had contravened PIPEDA by forcing them to consent to the 
collection of personal biometric information and to provide the information to enable 
a computer to automatically authenticate identity using their voice prints. 


The Assistant Privacy Commissioner assessed the requirement of the voice print 
and found it not overly invasive. She found it an appropriate balance between the 
employees’ right to privacy and the employer’s needs. The purpose was reasonable and 
appropriate, Telus had properly informed its employees of the purposes, and it had 
appropriate safeguards in place in relation to the information. 


After the release of the Assistant Commissioner’s findings, each of the four 
complainants filed a separate application in Federal Court under section 14 of 
PIPEDA. An order dated December 31, 2004 consolidated all of the applications 
under Federal Court File No. T-1865-04. 
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The Privacy Commissioner then sought under section 15(c) of PIPEDA to become 
a party to these applications in order to make representations to assist the court 
in developing a test for negotiating the balance between commercial needs and 
individual privacy rights. Telus consented to the motion but made representations to 
the Court suggesting a limited role for the Privacy Commissioner. The Commissioner 
successfully challenged this, and on February 22, 2005, obtained full party status. 


The Commissioner made representations on several matters, including: (1) that the 
Telecommunications Union was not a proper applicant in the proceeding; (2) that the 
Court should have due regard for the factors to be considered in balancing the interests 
of the parties; (3) that the legal framework and factors used by the Commissioner in 
balancing the interests of the parties should be applied by the Court; (4) that PIPEDA 
does not require that the employer seek union consent rather than seeking consent 
directly from individual employees; (5) that exceptions to consent requirements do 
not apply in this situation; (6) when may consent be implied; and (7) a recognition of 
the ability to withdraw consent. 


A hearing has been scheduled for September 20, 2005. 


John Testa and Brenda Marie Testa v. Citibank 
Federal Court File No. T-2135-04 


Mr. Testa claimed that Citibank disclosed a significant amount of his personal 
information to his employees without his consent. He further alleged that these 
disclosures were extremely damaging to his reputation and contributed to his decision 
to resign as the head of the company. 


In her finding, the Assistant Commissioner acknowledged that PIPEDA allows an 
organization to disclose an individual’s personal information without consent for the 
purposes of collecting a debt. However, this exception did not confer carte blanche 
for an organization to disclose however much information it wished. She felt that in 
this instance it was clear that excessive amounts of information had been divulged. 
Accordingly, she found the bank to be in contravention of Principle 4.3 of Schedule 
1 of PIPEDA and the complaint to be well-founded. 


An application was filed in Federal Court on December 1, 2004. The Commissioner 
was expected to seek leave to appear as a party as permitted by section 15(c) of PIPEDA. 
However, a settlement was reached at a pre-trial dispute resolution conference and, 
accordingly, the application was dismissed on June 15, 2005. 
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Richard Breithaupt and Peggy Fournier v. Hali MacFarlane and Calm Air International Ltd. 
Federal Court File No. T-2061-04 


Mr. Breithaupt complained that a Calm Air employee (Ms. MacFarlane) disclosed 
his and his wife’s itinerary information to the RCMP without their knowledge and 
consent. It was undisputed that the Calm Air employee had obtained access to the 
information without their knowledge and consent. However, both the Calm Air 
employee and the RCMP officer denied that the employee disclosed this information 
to the officer. 


Documentary evidence led the Assistant Commissioner to conclude that there was 
indeed a disclosure. She found that the employee had used personal information 
for purposes other than those for which it was collected, and then disclosed it in 
contravention of Principles 4.3 and 4.5 of Schedule 1 of PIPEDA. Accordingly, the 
complaint was well-founded. 


The complainant filed an application under section 14 of PIPEDA in Federal Court 
on November 18, 2004.’ The Commissioner is not a party to this application, though 
she is monitoring its progress. 


Judicial Review 


The following cases are important in defining the extent of the Commissioner's 
enforcement powers under PIPEDA: 


Blood Tribe Department of Health v. Privacy Commissioner of Canada et al. 
Federal Court File No. T-2222-03 and Federal Court of Appeal File No. A-147-05 


A complaint was filed with our Office alleging (among other things) that the 
Blood Tribe Department of Health had denied an individual access to her personal 
information and did not provide reasons for the denial. 


In our view, the Commissioner must have access to all documents to ensure that 
exemptions claimed have been properly applied and to guard against abuse. However, 
during this investigation the Blood Tribe Department of Health refused to provide 
the Commissioner with access to solicitor-client privileged documents. As a result, 
our Office issued its first order for the production of records, using the enforcement 
powers as set out in sections 12(1)(a) and (c) of PIPEDA. 
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In response, an application for judicial review of the Privacy Commissioner’s decision 
to issue an order for production was made by the Blood Tribe Department of 
Health, as permitted by section 18.1 of the Federal Court Act. The Court dismissed 
the application in March 2005. Mr. Justice Mosley stated that when the Privacy 
Commissioner is seized with a complaint over the retention and use of personal 
information, she has the responsibility to determine the facts and the duty to prepare 
a report of her findings. She cannot effectively perform that role if she is denied access 
to the information necessary to ascertain the facts merely because a claim of privilege 
is made. The Court was satisfied that the Commissioner had correctly exercised her 
authority to issue the production order. The order did not limit or deny any solicitor- 
client privilege that the applicant may enjoy in the questioned documents. 


The Applicant filed an appeal of this decision in April 2005. 


3web Corporation v. Llano Gorman and Privacy Commissioner of Canada 
Federal Court File No. T-1603-04 


Mr. Gorman complained that 3web Corporation, an internet service provider who had 
been his employer, had installed web-cameras to monitor employees in the workplace. 
The cameras were located in the sales and marketing division and the technical 
support staff area. The Assistant Commissioner concluded that the complaint was 
well-founded. In doing so, she stated that: (a) it was unlikely that a reasonable person 
would consider employee productivity to be an appropriate reason to use video and 
audio surveillance; and (b) by using web cameras in the manner described in this 
complaint, the company was not fundamentally recognizing the right of privacy of 
its employees; the balance integral to section 3 of PIPEDA was tipped too far away 
from the privacy rights of individuals. The use of cameras for these purposes would 
undermine PIPEDA. 


PIPEDA provides that a complainant or the Privacy Commissioner may apply to the 
Federal Court for a hearing of any matter referred to in the Commissioner's report. 
In that the Commissioner’s report makes recommendations only, there is no such 
provision for a respondent organization. In this case, the organization initiated a 
judicial review application. It named Mr. Gorman as a respondent, although it also 
sought an order stating that the Assistant Privacy Commissioner’s report was “illegal 
and invalid.” 


In October 2004, the Privacy Commissioner filed a motion requesting that (a) she 
be added as an intervener and (b) the application be struck. This motion was heard 
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in February 2005, at which time the Commissioner was added as an intervener to the 
proceeding. The Court dismissed the Commissioner’s motion to strike the application 
as a whole, concluding that the issue was best suited for determination at trial. 


The company discontinued the proceeding in June 2005. 
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Public Education and Communications | 


he Office of the Privacy Commissioner of Canada is mandated specifically 

under PIPEDA to develop and conduct information programs to foster public 

and organizational understanding and recognition of the rules that govern 
the collection, use and disclosure of personal information. And although there is 
no legislative mandate for public education specified under the Privacy Act, there 
is certainly a mandate to ensure departments and agencies are held accountable for 
their personal information handling practices. There is often a necessity to inform 
the public, as well as departments and agencies, about the requirements of the Act 
and related policies, and the impact on the privacy rights of Canadians of current and 
proposed government activities. 


In 2004, the Office undertook a strategic communications planning effort with the 
expertise of external consultants, and the result was a comprehensive communications 
and outreach strategy for the coming years. This strategy will enable the Office to have 
a more comprehensive, proactive approach to communications planning and delivery; 
a more truly public education-focused approach to communications surrounding 
PIPEDA,; and build a greater level of awareness of the Office and of key privacy issues 
under both laws. 


In addition to developing this strategy the Office undertook the following 
communications activities in 2004: 


Speeches and Special Events 
Speaking engagement opportunities have helped our Office raise awareness of 


privacy issues among diverse audiences and settings, including professional and 
industry associations, non-profit and advocacy groups and universities. In 2004, 
the Commissioner, Assistant Commissioners and other senior officials delivered 


Eee 


91 


Annuat Report To PARLIAMENT 2004 — Report ON PERSONAL INFORMATION ProTECTION AND ELectronic Documents Act 


19 speeches, speaking out about issues with privacy implications, such as security 
initiatives and health care delivery. 


In March 2004, the Office began hosting an in-house Lecture Series (approximately 
one per month). These information sessions featured experts on a variety of privacy 
issues and brought together members of the privacy community and staff. In 2004, 
the Office hosted ten of these information sessions. 


Media Relations 

Privacy issues continued to be of interest to the media in 2004, with significant 
coverage in Canada on issues such as the full implementation of PIPEDA, about 
which the Office received media calls and participated in interviews. In addition, 
through other proactive media relations efforts, such as the dissemination of news 
releases, the Office had the opportunity to raise awareness of, for example, the launch 
of its Contributions Program; the Commissioner’s views on important legislation, 
such as the Public Safety Act and the do-not-call list legislation; and the Office’s views 
regarding transborder flows of personal information. 


Web Site 

We post new and useful information on our Web site on an ongoing basis. Fact sheets, 
news releases, speeches, case summaries of findings under PIPEDA, are posted to 
keep the site interesting to individuals and organizations. In 2004-2005, the Office 
redesigned its Web site in order to make it compliant with the Common Look and 
Feel standards established by Treasury Board. This resulted in an enhancement to 
the design as well as to the navigation tools on the site, in order to help visitors make 
better use of the site. The Office also made the site more dynamic with the posting of 
a downloadable Web-video for businesses on complying with PIPEDA. Since 2001, 
we are pleased to report that visits to the site have more than quadrupled, reaching 
922,106 in 2004. 


Publications 

The Office has produced information materials, including guides for individuals and 
organizations on PIPEDA, as well as a variety of new fact sheets on issues including 
consent, use of the social insurance number in the private sector, transborder flow 
of personal information, and how our Office conducts investigations into potential 
privacy breaches. 
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In 2004-2005, in addition to preparing new fact sheets, we developed an e-kit 
for businesses to help them comply with the new law. We also revised the content of 
our guides, to ensure they were up-to-date given the final stage of implementation 
of PIPEDA on January 1, 2004. We received requests for these materials on a daily 
basis. Not only were these materials sent to individuals upon request, they were also 
distributed at conferences and special events, and accessed in electronic format by 
visitors to our Web site. In 2004, close to 22,000 of our publications (guides, fact 
sheets, annual reports, copies of both federal privacy laws) were sent out, in addition 
to the more than 742,000 publications which were downloaded from our Web site. 


Internal Communications 

Internal communications activities were also a focus of the Office and played a key 
role in 2004, increasing transparency between management and staff, especially during 
its ongoing institutional renewal, but also through day-to-day activities. Internal 
communications activities in 2004 involved providing staff with information on, for 
example, human resources issues, upcoming speaking engagements, Parliamentary 
appearances, senior management and labour management committee meetings, and 
special events such as all-staff meetings and information sessions. The Office has 
been developing an Intranet, an internal communications portal to host all internal 
communications and maximize staff access to information, which will be launched 


in 2005. 
In the upcoming year, the Office will continue to undertake the activities outlined 


above. We also hope to be in a position to initiate many of the more proactive public 
education activities outlined in the communications and outreach strategy. 


93 


ys _ F ‘Dh 
vw 


i ie a eee md Fold ty pias Pid pipers 
| . eh, ip i 0M 1: Tes ay nid Neh, bas eee ath es 
at ASN! 8 : ae WW ts Hs ee ero dt pate 
Whar a aa ere wah ek, Wy argh ¥ 
inn ce A shiny me ae Ms ee at 
eh Neg hdl Ato bs prior cmos + 
a capri sancti itary OH) OSES nad fun ily 7 
piaitn ad ch tmoat teud Aiaty alasakial 
bi it ies 2) ali aang ve ; 2 jaan 


‘agpibbs neo 
He lt o, ve ibid 
‘Wovay anne w “Mae eo 


‘id chy ae aah yi hue . 
tists bladed wir vant ph ate 08 panei b lai’ i 
—habtaced enti yi oosemalle Aviles bine jeep retard : i 
oS igo Jd WM indole recently vo taxvesa AAA SpUbglyyaniti . iia 
agrees. Abe gina: Galli. wpe, caren ela ‘ae | 


a 


| heey wit eR ein tertindais Gani hypnequnagolinge wou ernegaa ; 
"ait eee +a? ARI pte eiuewnptyed Thue any osm Fist ati ee Ayan angie fantsasige . 


Riri Dre: jhe’ sdb ag igtetety ey rn | A Ln | Jones ah whiquisyah rood ae 
1 tial apieblla elt Moab ablations wngatveon rehab eerianinte: heer 7 
ritir’, pais rey, at 7 migetss Bes mit SLY see Oa MAMA 1 TAD RSE IA, ar POT 4 ‘ 


‘agar! " dy er oe or Mot Bee alu hk POF MOS, vt! Gee | 
poi atioritigriy Ginlicanien, pig vinci lie, nical Wilko ayia Nala * 
ee Gee ae Se ee ee Pee hee BN, coca 
(oy PRlacnyeny oniall wes hash vena pate: ctr i digglls: edith uae 
» let Riv at Mia y . ae oy over a a ay Podge “ely Ohe jet ta. | 
Eke te fal a ee sleek Bini 4 
ae ok a jah ne saliighlh, coaehiy . 
PLS bi He 7 haan at a ae 
\ bs | | rh *e: 


i 
; 


Me) es a 

We Login ee a ee el}: ? 77 4 ap A+ chee 7 ‘ia iT’ Leufrvisttinds wir 
4 a BoD fy Se @ 4) 7 ais : ‘ inte 

AS oe Cae Na ( ai iu “Ny fan YS Ve a sey | Nelo ivy wali ty analog 


i ee oe a " io y We vin? w* - a) ene nor SNARE, a uahyewcdid Hea. 
A Pa ibe jaa fie mr) fen bine eg hy ie inc Sse 
a ey Wetetany, bat . p = 


: A) ‘ Gl J | > ‘ 
te af PY a 
a4 ; : ; : “- . vy Fy 
A f ) ' j * ; 4 = i 
Ps ii ve } “| nD oe le J + aT 
. a ee Ue 
{ } f : } ¥ > at ; 
: " = . r 
j 


Corporate Services 


On the Path to Institutional Renewal 


he Commissioner’s most immediate priority has been to lead the Office’s 
institutional renewal by strengthening OPC management processes, particularly 


human resources and financial management — planning, budgeting, reporting and 
control mechanisms. 


The overall financial framework in which our Office operates is based on the 
government fiscal year (2004-2005). 


Planning and Reporting 
A foundation component of the Office’s institutional renewal is a strategic planning, 


reporting and control process. During 2004-05 we completed our first year under 
this revised process. The strategic plan established at the beginning of the year was 
our road map for the year. As part of the new process were reporting and review 
opportunities. We made adjustments to plans and budgets throughout the year. 
To assist in our reporting and reviews we developed a Performance Measurement 
Framework and a monthly performance report. We also launched a Business Process 
Review of the entire organization which will enable the Office to better estimate 
resource requirements and to draft a business case for permanent funding. 


Human Resources 

We continue to work toward the development and implementation of changes to 
improve how the office is run and the quality of the workplace. Significant changes 
and improvements have been made to the Human Resource management policies 


and practices. 
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We developed a number of Human Resource policies in consultation with central 
agencies and unions. These policies will guide us as we build on the successes of 
the past year and we continue on our path of institutional renewal. An Instrument 
of Delegation of Human Resource Management was developed and will serve as 
a tool to inform and guide managers, and enable them to manage their human 
resources. A new Strategic Human Resource Plan and Staffing Strategy, as well as an 
Employment Equity Action Plan, will help the OPC achieve its mandate and ensure 
the recruitment of a highly qualified workforce that is diversified and representative 
of Canadian society. As part of OPC’s commitment to increase transparency in the 
staffing processes, a staff newsletter was developed; it is distributed on a monthly basis 


to all staff. 


Over the course of the past fiscal year we made significant strides in the area of 
organizational learning, including the development of a learning strategy with the 
Canada School of Public Service (CSPS), training and information sessions in values 
based staffing, language training sessions, performance management and employee 
appraisals and harassment in the workplace. The development and implementation 
of a Learning Strategy and Curriculum with the CSPS will enable staff to continue 
to develop the expertise and competencies required to fulfil their functions, as well as 
to position staff to take on new responsibilities and accountabilities. 


We continued to work collaboratively with Central Agencies such as the Public 
Service Commission and the Public Service Human Resources Management Agency 
of Canada on follow-up measures to the recommendations of the Public Service 
Commission and the 2003 report of the Auditor General of Canada. This included 
measures that will allow OPC the opportunity to regain its full staffing delegation 
authority. | 


Finance and Administration 

The OPC received a clean opinion on Audited 2003-2004 Financial Statements by 
the Office of the Auditor General of Canada. This is a significant milestone and 
a very positive indicator that the organization has indeed advanced on the path of 
institutional renewal. The organization has built on that success by establishing 
planning and review cycles, by streamlining and improving the financial management 
policies and practices. 


Information Management / Information Technology 


Signification advancements have also been made in how we manage our information 
assets. We completed an audit of our information management systems and we 
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completed a vulnerability assessment of our information technology. We also completed 
an information technology strategy. This will help us to not only meet our obligations 
with respect to the management of government information and security policies, but 
more importantly it will guide us as we move forward in improving on the management 
of our information assets. During the year we completed a significant upgrade to 
our case tracking and reporting system, Integrated Investigations Application (IIA). 
Finally we also established the framework for an internal Intranet site. This site will 
allow for effective communicating and sharing on information for employees. 


Down the road 

Strategic planning is an important annual exercise for the OPC. Our last session in 
January 2005 provided managers and employees an opportunity to re-examine the 
OPC’s priorities for 2005-2006, and the actions they would take to achieve these 


priorities. 
Corporate Services priorities for 2005-2006 are to: 


e Develop and implement a Management Accountability Framework (MAF); 

e Implement and maintain a human resource strategy that enables the 
Office to recruit, retain and develop staff and foster a continuous learning 
environment; 

e Satisfy central agencies’ requirements to regain delegated authorities, and 
enable the Office to take on new delegation to implement the Public Service 
Modernization Act; 

e Develop and implement integrated information management, 

e Complete Business Case for Resources for the OPC; 

e Review Corporate Services Branch and Human Resources Branch policies 
and procedures; and 

e Continue providing effective integrated financial services to the OPC. 


Our Resource Needs 

At the beginning of fiscal year 2004-2005, the Office’s budget was $11.2 million, 
the same as the previous year. Included was $6.7 million for the Office’s PIPEDA 
activities. Ongoing funding of OPC activities continues to be extremely important. 


With privacy rights continually under threat, the Office’s operations need to be funded 
adequately so that it is prepared to address the multitude of emerging privacy issues in 
the public and private sector. 
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Annuat Report To PARLIAMENT 2004 - REPORT ON PERSONAL INFORMATION PROTECTION AND ELectronic Documents Act 


The Office does not have adequate resources to fully exercise its powers and 
responsibilities under both Acts. Without adequate permanent funding, the Office 
cannot: 


e Reinforce our audit and review functions to effectively address compliance 
under both privacy laws or strengthen our capacity to monitor, research and 
respond to emerging issues of technology and privacy; 

e Conduct outreach and public education to influence change so policies and 
programs are viewed through a privacy lens; 

e Continue investigating in a timely manner and resolving the growing number 
of complaints under both Acts; and 

e Continue providing specialized legal and strategic advice and litigation 
support under both federal privacy laws, as well as strengthening established 
approaches and procedures to deal with cross-jurisdictional complaints. 


To this end, the Office’s priority beginning in the last quarter of fiscal year 2004- 
05 was to completely review all business processes. The review included establishing 
workload indicators and reviewing the legislative requirements, as well as external and 
internal factors that have an impact on our operations. This will enable the Office 
to develop a Business Case and make a formal submission to the Treasury Board 
Secretariat and to Parliament later in 2005 to stabilize our resource base and seek 


permanent funding for the Office. 


We hope that with adequate permanent funding, the Office can further assure 
Parliament that it is effectively ensuring respect for Canadians’ privacy rights in the 
public and private sectors. 
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Financial Information 


April 1, 2004 to March 31, 2005 


Expenditure Totals % of Totals 


($) 
Privacy Act 3,745,058 o2 
PIPEDA 6,849,650 58.5 
Corporate Services 1,107,296 9.5 
Total 11,702,004 100 


Note: Although OPC salary budget allows for approximately 100 FTEs (full-time equivalents), there 
were only 86 FTEs staffed at the Office at the end of March 2005. 


Detailed Expenditures” — Privacy Act PIPEDA Corporate Services Total 

Salaries 3,330,147 3,039,732 419,120 6,788,999 

Employee Benefits Program 190,327 844,575 154,640 1,189,542 

Transportation & 41,238 266,129 81,282 388,649 
Communication 

Information 1,907 147,911 5,239 155,057 

Professional Services 171,783 1397579 210,403 1,779,765 

Rentals 2,130 107,874 23,159 134,363 

Repairs & Maintenance 4,698 155,805 85,353 245,856 

Materials & Supplies 9,304 50,764 21,633 81,701 

Acquisition of Machinery & 384 451,788 98,026 550,198 
Equipment 

Other Subsidies & Payments - 7,460 20,084 7,841 20,465 

Transfer Payments 0 367,409 0 367,409 

Total 3,745,058 6,849,650 1,107,296 11,702,004 


” Total expenditure figures are consistent with the Public Accounts of Canada. 


Financial Statements 

The Management Responsibility letter and the audited financial statements as at 
March 31, 2005 will be available on our Web site at www.privcom.ge.ca in October 
2005. 
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May 2006 


The Honourable Noél A. Kinsella, Senator 
The Speaker 

The Senate of Canada 

Ottawa 


Dear Mr. Speaker: 
I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 


Electronic Documents Act for the period from January 1 to December 31, 2005. 


Yours sincerely, 


S al Ctowdatt 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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Dear Mr. Speaker: 
I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 


Electronic Documents Act for the period from January 1 to December 31, 2005. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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would like to report much good news about privacy 
in Canada. But it’s not all good news. Concern among 
Canadians about their loss of privacy and the misuse 
of their personal information has never been greater. 
This concern stems from the growing threats to personal 
information in an electronic environment of massive and 
continuous data circulation. 


Current private sector data protection legislation takes us only part way towards 
offering adequate privacy protection. The Personal Information Protection and 
Electronic Documents Act (PIPEDA) has now been in full force for two years. This 
law has brought Canadians outside Quebec a comprehensive suite of informational 
privacy rights. (Quebec adopted its own private sector privacy legislation in 1994.) 
It has introduced a corresponding range of obligations for organizations that collect, 
use and disclose personal information. 


In the wake of PIPEDA, several provinces have moved to adopt their own legislation, 
which were later declared to be “substantially similar” to the standards in PIPEDA. 
British Columbia and Alberta did so in 2003, and Ontario (in health privacy 
matters) in 2005. 


PIPEDA is slated for review by Parliament in 2006. This review is vital. It will present 
a unique opportunity to examine the Act’s effectiveness in protecting one of our 
cherished Canadian rights, informational privacy. It will also give Parliamentarians 
and the Canadians they represent the chance to respond to growing attacks on 
personal information through identity theft, spam and fraudulent on-line activities. 
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Despite their limitations, PIPEDA and the substantially similar provincial laws 

have promoted a sea change in attitudes toward personal information protection in 
Canada. Canadians now expect organizations to justify collecting and using personal 
information. They are becoming increasingly vocal and articulate about the handling 
of their personal information. 


The last few years have also created challenges for organizations covered by PIPEDA 
as they have moved, at different rates and with varying degrees of success, to 
implement the privacy principles of PIPEDA. Overall, the information handling 
practices brought to our attention show Canadian organizations demonstrating 

a high level of compliance with PIPEDA. Businesses, large and small, have 
demonstrated goodwill, commitment to community values and openness to change 
when it comes to protecting privacy. But Iam concerned that apparent compliance 
does not always result in truly effective privacy and security practice. Goodwill needs 
to be translated into practice. 


Technology, consumer trends and national security concerns continue to introduce 
novel uses for personal data and, indeed, require ever greater amounts of it. We must 
revisit how we define and apply our operating rules. How adequate are these rules in the 
world of the Internet, mini-computers in cars, tracking tags in clothing, satellite-assisted 
surveillance of neighbourhoods, and the outsourcing of data processing to countries 
lacking effective data protection standards? Even if we have a reliable framework for 
privacy protection in Canada, these protections do not always extend beyond our 
borders. Nor do they effectively control actions that, via the Internet, reach into Canada 
and use our personal information in ways that do not respect the principles of PIPEDA. 


At the Office of the Privacy Commissioner of Canada (OPC), we continue to 
support privacy values through education, outreach, complaint resolution and other 
preventive measures. As an ombudsman, I promote voluntary compliance with 
privacy principles, and their adaptation to specific industry and consumer needs. 

I am pleased that the recent trend towards settling the privacy complaints made to 
my Office is continuing. Almost half of all complaints are settled to the apparent 
satisfaction of all parties. 


As familiarity with privacy standards increases, so does the expectation that they 
will be observed. It is no longer acceptable that violations of personal information 
protection norms do not lead to direct remedial action. In 2005, I began asking 
organizations that are the subject of well-founded complaints to state the corrective 
measures they would take. I would then decide whether to seek a remedy for the 
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complainant in Federal Court. To date, in the few situations where I have used this 
approach, almost all organizations have rapidly committed to providing redress and 
making systemic changes. 


We continue to monitor whether the systemic changes we recommended have 
occurred in response to complaints made in previous years. Again, the overall 
compliance rate is high and, once we intervene following a complaint, the level of 
cooperation by organizations is generally commendable. 


However, it is difficult, if not impossible, to complain about misuse of personal 
information if individuals do not understand how their information is being 
used. The opaque nature of our technology-driven world means increasingly that 
only specialists understand the flows and uses of personal information. Because 
Canadians themselves may not fully understand the handling of their personal 
information, my Office has to rely on other indicators of privacy problems beyond 
those that surface through public complaints. We now use a variety of additional 
approaches including audit, review of information management systems, personal 
information assessments, public information and education to empower individuals 
and to help businesses with compliance, research on new issues and, where 
necessary, legal action. 


Our mandate under PIPEDA is broad and demanding, and we have been hobbled by 
perennial uncertainty over funding. We have not had permanent funding to carry 
out our mandated activities under PIPEDA, as funding for the new law was granted 
initially only until 2003 and then renewed annually. PIPEDA has now been in full 
force since 2004 and the pressures are increasing. We have requested a substantial 
multi-year increase in our funding base and are planning for significant growth. 
Adequate funding will enable us to do the job our legislation requires of us. It 

will allow us to meet the challenge of responding to the ever-growing appetites of 
commercial and governmental interests for our personal information. 


I would also like to commend the Honourable Gérard V. La Forest for his study 

on the possible merger of the offices of the Information Commissioner and the 
Privacy Commissioner. He concluded that a privacy-focused structure is the most 
appropriate framework for enforcing Canada’s privacy legislation. Retaining this 
structure also avoids the inevitable administrative upheaval that would flow from 
merging the two offices. It is far better at this time that our Office continues to focus 
our energies on the privacy issues that we now face, and that continue to emerge, in 
abundance. 
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o date, our Office has not received permanent funding to carry out its duties 

under PIPEDA. Funding was granted for three years only. PIPEDA came into 

force in stages, beginning in 2001 and reaching full implementation in 2004, and 
we thought it important to let the dust settle before we attempted to identify long-term 
financial needs. PIPEDA has now been in full force for two years, and the demands made 
of us under the Act are increasing. Current funding levels leave us unable to carry out 
our multi-faceted mandate. For example, we face a significant backlog of complaints, and 
complainants are, quite understandably, becoming impatient. The small size of our team 
of auditors makes it impossible to conduct effective audits to ensure compliance. Even 
though we have adopted a risk-based approach, we need to intensify our audit activities. 
Funding limits also mean that our communications strategy is primarily reactive, when 
proactive public education about privacy rights and obligations is required instead. 
Similarly, our Policy and Research Branch and our Legal Services Branch are confined to 
putting out existing privacy fires, rather than anticipating and therefore more effectively 
addressing emerging privacy issues. 


In the past few years, the Office went through an extremely challenging period. 
However, every cloud has a silver lining. In this case, the silver lining was an 
opportunity to review the functioning of the Office, in detail, from top to bottom. 
The result is an Office of the Privacy Commissioner of Canada that is pointed in the 
right direction. It is now time to put forward the Office’s new vision and we need the 
full set of tools to implement it. 


We are attracting new and highly specialized talent to our team. We have pursued an 
ambitious agenda to correct deficiencies in management of the organization. Audits 
and evaluations of our Office — by the Auditor General of Canada, the Public Service 
Commission and the Canadian Human Rights Commission — have so far been 
positive. And we have implemented a thoughtful, systematic process to determine 
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our organizational needs. This Office is now again an institution worthy of the trust 
of Parliament and the Canadians it serves. 


The Vision of the Office of the Privacy Commissioner of Canada 


The Office has prepared two analyses of significance — a Vision and Institutional 
Service Plan, and a Business Case for Permanent Funding. Together, these describe 
who we need to be, for Canadians and on behalf of Parliamentarians, and what it 
takes to get us there. 


If funded appropriately, the Office can accomplish the following in relation to the 
activities regulated under PIPEDA: 


* undertake a meaningful number of audits and reviews to encourage greater 
compliance, and assist in developing a robust privacy management regime 
in the private sector; 


* conduct legal and policy analyses of bills and legislation to assist Parliament; 


- make more proactive, extensive and effective use of the enforcement 
tools entrusted to us by Parliament, including Commissioner-initiated 
complaints, court actions and public interest disclosures; 


* carry out research into emerging privacy issues and trends to help citizens 
and policy makers understand current and future privacy challenges; 


* engage in extensive public education to better inform individuals of their 
rights, and organizations of their obligations; 


- through a streamlined investigation process, tackle the growing backlog of 
privacy complaints; and, finally, 


* sustain institutional renewal efforts. 


Business Case: Resources 


After a thorough analysis that included a Business Process Review of the 
investigations and inquiries functions and an in-depth review of all other functions, 
the Office requested a greater than 50 per cent increase in resources. The OPC is now 
planning for an increase within the next two years, to approximately 140 employees 
and an overall annual budget of approximately $18 million. 


Long-term, stable and increased funding is imperative for the OPC, for Canadians, 
and for the organizations covered by federal privacy laws. The OPC plans to move 
away from being predominately complaint-driven to a more multi-disciplinary 
approach, one that is more proactive than reactive, and one that better reflects the 
mandate given to us by Parliament. 


Standing on Guard for Privacy _ 


he focus of research and policy activity this year continued to relate to the 

provision of enhanced ability for law enforcement and national security 

agencies to obtain personal information. We reported on this extensively 
in the 2004-05 annual report on the Privacy Act, and will do so again in this coming 
year’s annual report on that Act. The issue also merits mention here because 
legislation discussed or introduced in Parliament this year seeks to compel private 
sector organizations to release personal information. 


The Commissioner appeared before the Senate Special Committee on the Anti- 
terrorism Act (ATA) on May 9, 2005. The accompanying position statement of our 
Office stressed the growing surveillance powers of the state as it seeks access to 
private sector repositories of personal data: 


Since 9/11, the Canadian government has introduced a series of measures to 
strengthen its surveillance powers over the citizens and residents of Canada. 

It also has massively invested in the development of integrated information 
systems that collect, process and share citizens’ and residents’ personal 
information, in a wide range of aspects of their economic and civic life: as 
travelers, investors, consumers, and recipients of social programs, to name a few. 


These information systems cross organizational and jurisdictional boundaries, 
and redefine the parameters of time and space. Records can now be kept 
indefinitely, accessed through delocalized nodes, and combined and aggregated 
to scrutinize virtually all aspects of private life. Systems to cross-tabulate and 
data-mine personal information are used to categorize, sort and classify people, 
and to infer, deduce, and make predictive judgments on individual attitudes 
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and behaviors. Many of the systems, through the use of biometrics, delve deeply 
into the personal realm of identity. 


The Commissioner appeared before the House of Commons Subcommittee on 

the Public Safety Act and National Security on June 5, 2005, to comment on the 
ATA, and issued similar warnings. While many concerns related to oversight of 

the agencies which have special powers under the Anti-terrorism Act, the Office 
raised concerns throughout the year that PIPEDA was being eroded by government 
access to private sector databases containing personal information. We are gravely 
concerned that information gathered for private or commercial reasons is finding 
its way into government hands. This amounts to a blurring of the public and private 
sectors, leading to the potential use of private sector companies as agents of the state, 
often without the safeguards that are elemental in a democracy. We must stand on 
guard against state access to the databanks of the corporate world. Fears of terrorist 
attacks or impending pandemics provide superficially attractive justifications for 
intrusive powers, but the real need for these powers is often not apparent. 


Some may argue that the Privacy Act can soften the edges of these intrusive powers. 
However, the Act, which governs government information collection and practices, 
is more than 20 years old and too antiquated and weak to provide meaningful 
oversight and redress for those who have been wronged. The Act was drafted even 
before the advent of desktop computers, let alone the myriad of other advances that 
enable surveillance at the push of a button. 


On November 15, 2005, the Minister for Public Safety and Emergency Preparedness 
Canada introduced Bill C-74, An Act regulating telecommunications facilities to 
facilitate the lawful interception of information transmitted by means of those facilities 
and respecting the provision of telecommunications subscriber information. Although 
the Bill died when Parliament was dissolved for the January 2006 federal election, 
the Bill or a variant may well be reintroduced. 


The Bill would have required telecommunications service providers to 

establish and maintain certain capabilities to facilitate the lawful interception 

of information transmitted by telecommunications. The Bill would also have 
required telecommunications service providers to provide basic information about 
subscribers to the RCMP, the Canadian Security Intelligence Service (CSIS), the 
Commissioner of Competition and any police service constituted under the laws of 
a province. The legislation would have lowered the standard (at present, a warrant) 
that must be met to obtain disclosure of personal information. Among the main 
provisions of the legislation were the following: 


e the requirement that all wireless, wireline, Internet and other 
telecommunications service providers be required to maintain existing 
intercept capabilities, and build in intercept capability as they upgrade their 
networks. Companies would be audited to ensure they are complying; 

e the ability of law enforcement agencies, namely the RCMP and any police 
service constituted under the laws of a province, CSIS or the Commissioner 
of Competition, to require telecommunications service providers to 
surrender certain subscriber data (name, telephone number, address, e-mail 
address, IP address) upon request, without any judicial authorization. This 
would represent a change from the present situation where, under section 
7(3)(c.1) of PIPEDA, companies are permitted to refuse requests unless they 
are accompanied by judicial authorization. Bill C-74 would have eliminated 
this discretion. 


The former Bill C-74 would have also required providers to: 


e enable the interception of communications generated by or transmitted 
through the service provider’s network; 

e deliver the intercepted communications to law enforcement agencies and 
GSIS; 

e isolate or separate a communication that is authorized to be intercepted 
from other information/communications; 

e enable simultaneous interceptions, by authorized persons from multiple 
national security and law enforcement agencies, of communications 
of multiple users. This means, for example, that a telecommunications 
company would have needed the capability to allow more than one agency 
to intercept multiple communications at the same time. The maximum 
capability that the Bill would have required was one intercept for every 
5,000 subscribers. 


Although this legislation was introduced in late 2005 and was not adopted, it is an 
excellent example of the growing reliance on private sector companies as “agents” of 
the state. Electronic surveillance of communications — “wiretapping” — is far from a 
new phenomenon, but what wiretaps produce in the age of electronic commerce and 
delivery of multiple services over the Internet is vastly greater than what flowed from 
tapping a telephone line. We expect that the privacy issues raised in the former Bill 
C-74 and any successor would preoccupy this Office and many civil liberties groups 
in 2006. 


We also watched with interest the consultation undertaken by the Department of 
Finance on revising the anti-money laundering/anti-terrorist financing (AML/ATF) 
regime to meet international commitments. Canada is a member of the Financial 
Action Task Force (FATF), the international inter-governmental agency that 
establishes and oversees AML/ATF initiatives. In our letter to the Department, we 
stressed that not all countries are the same, and that Canada happens to have a well- 
regulated financial industry with significant privacy legislation governing financial 
records and institutions. We recognized the need to ensure that Canada does not 
become a safe haven for money launderers, but also stressed that Canada should not 
be expected to adopt every measure proposed by the FATF without critical scrutiny 
of the measure’s privacy implications. 


The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) 
significantly weakens the protections provided by both PIPEDA and the Privacy 
Act. An individual’s ability to lodge a complaint, and the Privacy Commissioner’s 
power to investigate the complaint, are meaningless, given the secrecy surrounding 
the collection of personal information by the Financial Transactions and Reports 
Analysis Centre of Canada (FINTRAC). FINTRAC’s mandate is to assist in the 
detection, prevention and deterrence of money laundering, terrorist activity 
financing and/or threats to the security of Canada. The secrecy surrounding the 
collection of information by FINTRAC will prevent members of the public from 
knowing that information is being collected about them or that they are being 
investigated. We are seeing calls for more information to be scooped up in this 

net of financial surveillance, all without the knowledge of the individual, and we 
must protest the lack of attention to the very real privacy issues that flow from this 
expansion in the surveillance powers of government. 


In May 2005, a multi-stakeholder task force struck by the Minister of Industry 
reported on a one-year study of the problem of unsolicited email, or “spam.” 

Our Office participated on this task force, and we were gratified to see a strong 
commitment from the Minister to move forward rapidly to combat a pestilence 
that is undermining trust in the Internet and exposing hapless computer users to 
scams, identity theft, and even malevolent software or “spyware” that surreptitiously 
invades and compromises computers and the information they hold. As with many 
other important issues, the Office has received relatively few complaints on the 

use of email address information without consent. However, this is a much more 
significant issue than the limited number of complaints would suggest. We look 
forward to further government action in 2006. 
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Most spam originates outside Canada. This is a significant problem, since it is very 
difficult to investigate and prosecute the originators of spam. A similar difficulty 
arises with many other Internet scams, and even with legitimate businesses outside 
Canada collecting and processing personal information. We have struggled with 
this issue in a number of PIPEDA complaints this year. In response, we are now 
placing greater emphasis on harmonized international solutions and cooperation 
among data commissioners. In 2004, we reported on the significant concerns raised 
by the USA PATRIOT Act for the personal information of Canadians held both 
outside and inside Canada, and on the extensive investigation of this issue by the 
B.C. Information and Privacy Commissioner. Governments at both provincial 

and national levels need to remain alert to this and other issues related to the 
outsourcing of personal information. 


We must all work more effectively at the international level to find solutions to the 
privacy issues flowing from outsourcing, just as law enforcement has attempted to 
address crime and money laundering internationally. Our data protection agencies 
simply do not have the resources (or the legal authority) to chase perpetrators 

on foreign soil, so it is in our interest to work towards harmonized international 
standards and approaches. Canada benefits enormously from outsourcing, so 

we are good candidates to advance solutions that work for exporters, processors 
and individuals. And we find it more important than ever to communicate with 
international bodies that focus on ways of increasing international cooperation 

in a number of areas. The Commissioner was invited by the Organisation for 
Economic Co-operation and Development (OECD) to play a significant role in 
trans-border cooperation, and work started in the autumn of 2005. To this end as 
well, the Assistant Commissioner for PIPEDA has attended meetings in Korea and 
Hong Kong this year on the Asia-Pacific Economic Cooperation (APEC) Privacy 
Guidelines. The participation and expertise of the Government of Canada in this 
exercise has clearly exerted a positive influence on the Guidelines, bringing them 
closer to the Canadian data protection model. The Assistant Commissioner also 
attended a meeting on travel documents hosted by the OECD and the International 
Civil Aviation Organization (ICAO) in Britain. 


The Commissioner, the Director General Legal Services and the Director of Research 
and Policy attended the International Data Protection and Privacy Commissioners 
Conference in Switzerland in September 2005. Our Office will be hosting the 2007 
International Data Protection and Privacy Commissioners Conference. We look 
forward to welcoming more than 60 data commissioners and their staff, as well as 
members of privacy advocacy groups and the business community, among others, 
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from Canada and around the world, and to working on practical ways to implement 
data protection measures, wherever personal data may be held. A common focus 

on technological issues such as biometrics, Radio Frequency Identification (RFID), 
standards for authentication and identity management, and surveillance devices, will 
hasten implementation of measures to better protect privacy and reduce costs for 
business. 


The Year in Parliament 


The Office had a busy year in its relations with Parliament in 2005. A key component 
of our work involves appearing before Senate and House of Commons committees 
to provide expert advice on the privacy implications of bills and other policy matters 
under consideration by Parliament. 


The Office was called on to appear before parliamentary committees 16 times this 
year — a considerable challenge for our small organization. Yet because the Privacy 
Commissioner is an Officer of Parliament, such appearances are central to her 
duties. 


A key Committee for the Office is the relatively new Standing Committee of 

the House of Commons on Access to Information, Privacy and Ethics (ETHI). 
Established in late 2004, this Committee is significant in that with its creation, 
Canadians now have a standing committee of the House of Commons dedicated 

to privacy matters. The Privacy Commissioner of Canada and other OPC officials 
appeared four times before the ETHI Committee in 2005. While one reason for 
these appearances was to question us on the operations of our Office through 
examination of our Estimates and Annual Reports, MPs on the Committee also 
had many questions and concerns regarding some of the key privacy challenges and 
opportunities facing Canadians. The OPC looks forward to a continued, productive 
working relationship with this Committee in the 39" Parliament. As privacy issues 
continue to grow in number and complexity, it is vital that Parliament have a focus 
to examine these issues and reflect on the concerns expressed by Canadians. 


The overwhelming majority of our appearances before parliamentary committees 


involved bills and policy issues that relate to the Privacy Act, but three dealt with 
issues relating primarily to PIPEDA. 
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% Senate Study of the Financial Services Sector 


On February 16, 2005, we appeared before the Standing Senate Committee on 
Banking, Trade and Commerce to assist with its study of consumer issues in the 
Canadian financial services sector. The Senate had asked the Committee to examine 
the impact of federal legislation and initiatives designed to protect consumers 
within the financial services sector. The Committee was also asked to review the 
effectiveness of agencies that play a role in consumer protection and supervision of 
the financial services sector. 


As the complaints statistics set out in this annual report show, we receive more 
complaints about financial institutions than about any other industry. This has 
been true every year since 2001, the year the first phase of PIPEDA came into force. 
However, as we advised the Senate Committee, this does not necessarily mean that 
financial institutions are failing to comply with PIPEDA. We suspect instead that it 
reflects the amount and the sensitivity of personal information that banks and other 
financial institutions are required to collect, the central role they play in our day-to- 
day lives, and perhaps the complexity of our relationships with these institutions. 


Many complaints we receive do not flow from systemic problems. Instead, they are 
the result of actions by particular employees who failed to follow company policies 
and procedures. With complaints that we determine to be well-founded, financial 
institutions typically are prepared to adopt our recommendations for corrective 
action. As we indicated to the Senate Banking Committee, our Office generally has a 
very positive relationship with financial institutions. 


The Senate Committee did not have the opportunity to table its final report because 
of the dissolution of Parliament with the federal election call. We look forward to 
continuing to work with the Committee on this study when the new Parliament is 
convened. — 
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3% Bill C-37 and the “Do-Not-Call List” 


On June 8, 2005, we appeared before the House of Commons Standing Committee 
on Industry, Natural Resources, Science and Technology to provide our views 

on Bill C-37, An Act to Amend the Telecommunications Act. The Bill enables the 
Canadian Radio-television and Telecommunications Commission (CRTC) to 
establish a national do-not-call list. It also gives the CRTC the power to levy 
substantial penalties against telemarketers who do not follow the rules, and to 
contract with a private sector third party to operate the do-not-call service. Once 
the list is operational, Canadians who do not wish to receive calls from companies 
offering goods and services will be able to add their telephone numbers to a single, 
centralized list that telemarketers will be required to download regularly and respect. 
Both the United States and the United Kingdom have similar systems. 


When we appeared before the Committee, we welcomed the establishment of a 
do-not-call list. However, we advised that the exemptions from the list that the 
Committee was considering not be introduced until after consultations with 
Canadians. When we appeared before the Committee, the OPC had the support 

of some ten privacy commissioners across Canada encouraging consultation with 
Canadians about these exemptions — for example, exemptions for charities, pollsters 
or businesses that had prior relationships with the customer. 


The revised Bill adopted by Parliament contained several exemptions from the 
do-not-call list. The revised Bill did not prohibit unsolicited telecommunications 
made by or on behalf of a registered charity; a registered political party; a 
nomination contestant, leadership contestant or candidate of a political party; 

or an association of members of a political party. The Bill also did not prohibit 
unsolicited telecommunications to a person with whom the caller has an existing 
business relationship and who has not made a do-not-call request to that caller, and 
unsolicited telecommunications made for the sole purpose of collecting information 
for a survey of members of the public. 


Bill C-37 received Royal Assent on November 25, 2005. We are pleased with its 
enactment, but the exemptions unnecessarily weaken the legislation. 
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% Bill C-57 and Financial Institutions 


On November 15, 2005, we appeared before the House of Commons Standing 
Committee on Finance to address Bill C-57, An Act to amend certain Acts in 

relation to financial institutions. The Bill made changes to the corporate governance 
framework of banks, bank holding companies, insurance companies, insurance 
holding companies, trust and loan companies and cooperative credit associations 
to bring the acts governing those institutions up to the standards adopted in 2001 
for business corporations under the Canada Business Corporations Act. The Bill also 
updated certain governance standards that are unique to financial institutions. 


Bill C-57 contained only a few provisions relating to the collection, use or disclosure 
of personal information. These included a series of provisions requiring the 
directors or officers of banks and other financial institutions to report any interest 
they may have had in a material contract or material transaction with the bank 

or other financial institution. Related provisions allowed shareholders to review 
these disclosures. C-57 also allowed shareholders to obtain personal information 
about other shareholders, provided that the information would be used only for the 
purposes specified in the Bill. 


When we appeared before the Committee, we did not have any significant concerns 
with the Bill from a privacy perspective. We found nothing that directly affected 
customer information. We argued that the new emphasis on corporate governance 
in the proposed legislation might even enhance privacy protection because it 
would force corporations to become more aware of the risks of poor management 
practices, and it would also result in corporations placing greater emphasis on 
security considerations. 


Bill C-57 received Royal Assent on November 25, 2005. 
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n 2005, the OPC awarded a total of $148,850 to five organizations through 
its Contributions Program for research into emerging privacy issues. This 


program has been part of our annual budget since 2000, but was made 
operational only in 2004. Studies conducted under the program delve into the 
thriving data brokerage industry, the use of DNA samples, workplace surveillance, 
and compliance with and enforcement of PIPEDA. 


This is the second year of the program, which was launched in June 2004 to support 
research by not-for-profit groups, including educational institutions, industry and 
trade associations, and consumer, voluntary and advocacy organizations. Its goal is 
to further the development of a national research capacity in Canada on the broad 
spectrum of issues that have an impact on privacy. 


The OPC is mandated to undertake and publish research related to the protection 
of personal information. The program was set up as part of the Office’s budget 
pursuant to its program/legislative authority under PIPEDA. 


Over the past two years, the Contributions Program has awarded a total of $520,440. 
Research bodies across Canada are invited to apply for grants to examine various 
privacy issues. After a thorough screening process, the organizations are then 
awarded the resources to initiate the research. 
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The following projects were funded in 2005: 
Canadian Internet Policy $50,000 
_and Public Interest Clinic 
Ottawa, ON 


Ryerson University $36,150 


Toronto, ON 


University of British Columbia 


$27,000 
Vancouver, BC 


British Columbia Civil Liberties Association 
Vancouver, BC 


$24,200 


University of Ottawa $11,500 


Ottawa, ON 


The projects are expected to be completed in 2006. Links to the sites where they are 
published will appear on the OPC’s web site. 
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ection 26(2)(b) of PIPEDA permits the Governor in Council to issue an order 

exempting an organization, a class of organizations, an activity or a class of 

activities from the application of PIPEDA with respect to the collection, use 
or disclosure of personal information that occurs within a province that has passed 
legislation that is substantially similar to PIPEDA. 


The intent of this provision is to allow provinces and territories to regulate the 
personal information management practices of organizations operating within their 
borders and to promote a common standard for privacy protection throughout 
Canada and across sectors. 


If the Governor in Council issues such an order, PIPEDA will not apply to the 
collection, use or disclosure of personal information by organizations subject to 

the provincial law. Personal information that flows across provincial or national 
borders will continue to be subject to PIPEDA, and the Act will continue to apply 
within a province to the activities of federal works, undertakings and businesses that 
are under federal jurisdiction — for example, banks, airlines and broadcasting and 
telecommunications companies. 


Process for Assessing Provincial and Territorial Legislation 


Industry Canada has announced that to be substantially similar, provincial or 

territorial laws must: 

e incorporate the ten principles in Schedule 1 of PIPEDA; 

e provide for an independent and effective oversight and redress mechanism with 
powers to investigate; and 
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e restrict the collection, use and disclosure of personal information to purposes 
that are appropriate or legitimate. 


Substantially Similar Provincial 
and Territorial Legislation EnactedtoDate 0 


Our Office is required by section 25(1) of PIPEDA to report annually to Parliament 
on the “extent to which the provinces have enacted legislation that is substantially 
similar” to the Act. 


In November 2003, the Governor in Council issued an Order in Council (P.C. 
2003-1842, 19 November 2003) declaring Quebec’s An Act Respecting the Protection 
of Personal Information in the Private Sector substantially similar. The Act, which 
predated PIPEDA, came into effect on January i 1994. 


British Columbia and Alberta each adopted legislation in 2003 that applies to all 
organizations within the two provinces, except for those covered by other provincial 
privacy legislation, and federal works, undertakings or businesses that remain 
subject to PIPEDA. The two laws — both called the Personal Information Protection 
Act — came into force on January 1, 2004. 


The Governor in Council has issued two Orders in Council (P.C. 2004-1163, 12 
October 2004 and P.C. 2004-1164, 12 October 2004) exempting organizations, other 
than federal works, undertakings or businesses, in Alberta and British Columbia 
respectively, from the application of PIPEDA. 


Ontario’s Personal Health Information Protection Act (PHIPA) came into force on 
November 1, 2004. PHIPA establishes rules for the collection, use and disclosure of 
personal health information by health information custodians in Ontario. Health 
information custodians are individuals or organizations listed under PHIPA that, 
as a result of their power or duties, have custody or control of personal health 
information. 


In September 2004, our Office informed Industry Canada that we believe PHIPA 

is substantially similar to PIPEDA. In November 2005, the Governor in Council 
issued an Order in Council (P.C. 2005-2224, 28 November 2005) exempting health 
information custodians in Ontario from the application of PIPEDA. As a result, 
Ontario health information custodians will not be subject to PIPEDA with respect to 
the collection, use and disclosure of personal health information. The Information 
and Privacy Commissioner of Ontario will be responsible for ensuring compliance 
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with PHIPA, including investigating complaints about the personal information 
practices of health information custodians within the province. 


The Privacy Commissioner of Canada will continue to be responsible for oversight 
in relation to the collection, use and disclosure of personal health information that 
crosses provincial boundaries in the course of commercial activity. As well, our 
Office will continue to be responsible for personal health information collected, 
used or disclosed in the course of commercial activities by organizations that are not 
health information custodians. 
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he year 2005 was the second year in which PIPEDA covered all commercial 
activities in provinces that do not have substantially similar legislation. 


We saw a large drop in 2005 in the number of complaints filed under 
PIPEDA. We received 400 complaints in 2005, compared with 723 in the previous 
calendar year. 


Complaints received between 
January 1 and December 31, 2005 


Breakdown by Sector Count Percentage 


Insurance 


Accommodation 


Rental 
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We can only speculate about the reasons for fewer complaints. The volume of 
incoming complaints in 2004 was itself an increase over previous years, largely 
due to the full implementation of the Act and its coverage of new activities such 

as insurance, retail and accommodation, and professions such as law. The 400 
complaints we received in 2005, while only 55 per cent of the number we received in 
2004, were still considerably more than we received in 2001, 2002 or 2003. 

We hope that the decrease in complaints indicates greater awareness by 
organizations of the need to comply with PIPEDA. That awareness would be 
expected to produce at least two benefits. First, organizations would bring their 
personal information management practices into compliance with PIPEDA. 
Second, if compliance problems arose, the organizations’ privacy officers would be 
more conversant with PIPEDA and better able to resolve problems directly with 
individuals. 


Greater awareness and understanding of PIPEDA may simply come with time. The 
reduction in complaints in 2005 was generally greater in sectors covered since the 
first phase of PIPEDA came into force in 2001. PIPEDA has applied since 2001 to 
financial institutions, telecommunications and interprovincial or international 
transportation. Financial institutions — which handle by far the greatest quantity 
of personal information — were once again the most frequent object of complaints, 
but the number of complaints was just over half (53 per cent) what it was in 2004. 
The decline was of a similar scale in the transportation (58 per cent of the total for 
2004) and telecommunications (44 per cent) sectors. In the health sector, which has 
been covered since 2002, the decline was precipitous; we received only 11 per cent 
of the number of complaints we received in 2004 (although these statistics may be 
unreliable as indicators of trends because of the small number of complaints). 


Complaints in the more recently covered sectors declined as well, except for the 
accommodation sector, where the number remained roughly the same as in the 
previous year. In the retail sector, complaint numbers were 54 per cent of the 2004 
total; this may indicate a very quick uptake of PIPEDA principles by the retail sector. 
In other cases, the decline was less dramatic. The number of complaints involving 
insurance companies was 73 per cent of what it was in 2004, and complaints about 
professionals declined to 87 per cent of their previous level (although here again, the 
apparent trends may not be statistically significant, given the small numbers). 
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Definitions of complaint types under PIPEDA__ 


Complaints received in the Office are categorized according to the principles and 
provisions of PIPEDA that are alleged to have been contravened: 


Access. An individual has been denied access to his or her personal 
information by an organization, or has not received all the personal 
information, either because some documents or information are missing or 
because the organization has applied exemptions to withhold information. 


Accountability. An organization has failed to exercise responsibility for 
personal information in its possession or custody, or has failed to identify an 
individual responsible for overseeing its compliance with the Act. 


Accuracy. An organization has failed to ensure that the personal information 
it uses is accurate, complete, and up-to-date. 


Challenging compliance. An organization has failed to put procedures or 
policies in place that allow an individual to challenge its compliance with the 
Act, or has failed to follow its own procedures and policies. 


Collection. An organization has collected personal information that is not 
necessary, or has collected it by unfair or unlawful means. 


Consent. An organization has collected, used or disclosed personal 
information without valid consent, or has made the provision of a good or 
service conditional on individuals consenting to an unreasonable collection, 
use, or disclosure. 


Correction/Notation. The organization has failed to correct personal 
information as requested by an individual, or, where it disagrees with 
the requested correction, has not placed a notation on the information 
indicating the substance of the disagreement. 


Fee. An organization has required more than a minimal fee for providing 
individuals with access to their personal information. 


Retention. Personal information is retained longer than necessary for the 
fulfillment of the purposes that an organization stated when it collected the 
information, or, if it has been used to make a decision about an individual, 
has not been retained long enough to allow the individual access to the 
information. 


Safeguards. An organization has failed to protect personal information with 
appropriate security safeguards. 
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e Time limits. An organization has failed to provide an individual with access 
to his or her personal information within the time limits set out in the Act. 


e Use and disclosure. Personal information is used or disclosed for purposes 
other than those for which it was collected, without the consent of the 
individual, and the use or disclosure without consent is not one of the 
permitted exceptions in the Act. 


Complaints received between January 1 and December 31, 2005 
See ieee: Aaa aReT IER Re Samm: 

Access 
- Collection 

Safeguards 

Consent 

Time Limits 
ee ee 
Openness 

Iracy . 


Corre tion/Notation 


Retention 

Challenging Compliance 
Other 
Total 


This year, the most common matter raised in complaints was the inappropriate use 
or disclosure of personal information. These complaints, along with those about 
refusal of access to personal information and inappropriate collection of personal 
information, comprised nearly 73 per cent of the complaints received. Last year, the 
picture was similar, with these categories of complaints constituting 79 per cent of 
the total. 
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Definitions of Findings and Other Dispositions 


The Office has developed a series of definitions of findings and dispositions to 
explain the outcome of its investigations under PIPEDA: 


e Not well-founded. The investigation uncovered no or insufficient evidence 
to conclude that an organization violated the complainant’s rights under 
PIPED A 


e Well-founded. An organization failed to respect a provision of PIPEDA. 


e Resolved. The investigation substantiated the allegations but, prior to the 
conclusion of the investigation, the organization took or committed to take 
corrective action to remedy the situation, to the satisfaction of our Office. 


e Well-founded and resolved. The Commissioner, being of the view at the 
conclusion of the investigation that the allegations were likely supported 
by the evidence, before making a finding made a recommendation to 
the organization for corrective action to remedy the situation, which the 
organization took or committed to take. This finding category does not 
appear in the statistical tables, as it was introduced towards the end of 2005. 
It will appear in our statistics next year. 


e Settled during the course of the investigation. The Office helped negotiate 
a solution that satisfies all involved parties during the course of the 
investigation. No finding is issued. 


e Discontinued. The investigation ended before a full investigation of all the 
allegations. A case may be discontinued for any number of reasons — for 
instance, the complainant may no longer want to pursue the matter or 
cannot be located to provide information critical to making a finding. 


e No jurisdiction. The investigation led to a conclusion that PIPEDA did not 
apply to the organization or activity that was the subject of the complaint. 


e Early resolution. This applies to situations where the issue was dealt with 
before a formal investigation occurred. For example, if an individual filed 
a complaint about a type of issue that the Office had already investigated 
and found to comply with PIPEDA, we would explain this to the individual. 
“Early resolution” would also describe the situation where an organization, 
on learning of allegations against it, addressed them immediately to the 
satisfaction of the complainant and this Office. 
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Case summaries of the Commissioner’s findings under PIPEDA are available on the 
OPC web site, www.privcom.gc.ca. 


Findings by Complaint Type 


What do complaints tell us about business organizations’ compliance with PIPEDA? 
We should be cautious about reading too much into the number of complaints 
received, since an investigation may reveal that a complaint is not well-founded. It 
may be more appropriate instead to look at the findings in complaints. The chart 
below shows the outcome of our investigations of the different types of complaints 
in 2005. 


Complaints closed between January 1 and December 31, 2005 


Discontinued Early No Not Well- | Resolved Well- | TOTAL 
Resolution | Jurisdiction | founded founded 
: 7 


Use and 
Disclosure _ 
Access 11 
i : on : 


Safeguards 


Accuracy 
Time Limits 
Correction/ 
Notation 0 
Accountability 
Retention 
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Openness 
Challenging 
Compliance 
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eonoag oOo 
2 Oo 0 eG 


So |= = & 


15 77 47 157 41 401 


It is notable that, of 401 complaints, only 77 (19 per cent) were “not well founded.” 
In other words, the Commissioner could conclude that organizations had complied 
with PIPEDA’s requirements in less than one in five cases. The converse of this — the 
number of cases where the Commissioner could say that organizations had not 
complied with PIPEDA’s requirements — is more difficult to state conclusively. The 
number of well-founded cases is relatively small — 41, or 10 per cent — but many 
privacy issues are addressed by means other than full investigation, and therefore 
appear as “settled,” “resolved” or “early resolution.” 
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The significance of these numbers becomes clearer when we look at the types of 
complaints involved. The majority of complaints were of three types: use and 
disclosure (149, or 37 per cent), access (81, or 20 per cent), and collection (66, or 16 
per cent). Of these, access complaints — where an individual has been denied access 
to his or her personal information by an organization — are the most easily remedied. 
A refusal by an organization to allow an individual access to personal information 
can be corrected by the organization granting access or by demonstrating that 
legitimate exceptions to the right of access apply. The ease with which access 
complaints can be remedied is reflected in the relatively high proportion (64 per 
cent) that were either settled in the course of investigation or that we considered 
resolved by the organization. Still, the large number of access complaints may be 
worrisome; it may suggest that some organizations still do not fully comprehend 
their responsibilities under the access provisions of PIPEDA. However, the number 
of successful resolutions is encouraging. 


Complaints about inappropriate use, disclosure or collection are more troubling. 
These are complaints for which no simple remedy exists. If someone’s personal 
information is inappropriately disclosed, it cannot be recalled. If someone’s personal 
information has been inappropriately collected, the collection cannot be reversed. 
The Commissioner found that organizations complied with PIPEDA’s requirements 
(the complaints were “not well-founded”) in only 26 per cent of the collection 
complaints and 21 per cent of the use and disclosure complaints. 


For this reason, we intensified our focus in 2005 on maximizing the possible 
remedies under PIPEDA. We introduced a new procedure to allow the 
Commissioner to exert greater pressure on organizations to change their practices 
so that, if the damage to an individual cannot be undone, at the very least it will 

be less likely to happen to someone else in future. If an investigation indicates a 
likely contravention of PIPEDA, the Commissioner intervenes early, before making 
a finding about the complaint, with a recommendation to the organization as to 
how to remedy the matter. She then asks the organization to indicate within a set 
time how it will implement the recommendation. After receiving the organization’s 
response, the Commissioner issues her finding. 


The results of this approach have been encouraging, and it has led us to develop a 
new category of complaint finding, “well-founded and resolved.” (This new finding 
category does not appear in the statistical tables, as it was introduced towards 

the end of 2005.) This is more than simply an exercise in rewording. It shows 

that organizations, almost without exception, have accepted the Commissioner's 
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recommendations and implemented them in a timely manner. For a person whose 
privacy has been irreversibly violated, this approach offers something beyond the 
satisfaction of knowing that the investigation supported their allegations; their 
complaint has led to a change; it has made a difference. 


The table dealing with “complaints closed” also shows that our emphasis on 

settling complaints in the course of investigations continues. We commented last 
year that an increased focus on settlement of complaints was one way to address 

our complaints workload. This year, as in 2004, settlement during the course of 

the investigation was by far the most frequent disposition of our cases. Of the 401 
complaints closed in 2005, 157 (39 per cent) were settled during the investigation. 
This included 38 per cent of the collection complaints and 35 per cent of the use and 
disclosure complaints. We will continue to seek settlements of complaints because 
settlement is a fundamental aspect of an ombudsman’s role, helping organizations 
change their cultures and sort out their problems with clients and employees. 


During the year, we closed 401 complaints. This is an improvement over the 
previous two years, and it broke the trend of the last three years where we had 
received more complaints than we closed. In 2005, we closed as many complaints as 
we received. (A complaint received in one calendar year is not necessarily completed 
in that year, which is why we can close more complaints in a year than we receive.) 


This has helped to reduce our complaints backlog but, like any organization that has 
a public complaints function, we constantly struggle to balance our resources and 
keep up with the influx of complaints. Some new resources will be made available in 
2006 to deal with complaints, but our focus remains on finding ways to streamline 
procedures and process cases more effectively and efficiently. 


Complaint Investigations Treatment Times __ 


The following tables show the average number of months taken to complete a 
complaint investigation, from the date the complaint is received to when a finding 
is made or another type of disposition occurs. The first table breaks this down by 
finding or disposition, the second by complaint type. 
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Complaint Investigations Treatment Times for the period between January 1 and 
December 31, 2005, by Finding or Disposition 


Finding or Disposition Average Treatment Time in Months 


Resolved — 


Discontinued 


10.94 


Overall average — 


Complaint Investigations Treatment Times for the period between January | and 


December 31, 2005, by Complaint Type 
Complaint Type Average Treatment Time in Months 


Collection 


Use and disclosure 


Accountability © 


Overallaverage ts” 
* The treatment time for these complaint types reflects four or fewer cases each. 
** The treatment time for this complaint reflects one case only. 
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These tables of through-put times are troubling. Section 13 of PIPEDA requires 

the Commissioner to prepare her report on a complaint within one year after 

the filing of the complaint. As the tables show, the average time elapsed from 

the date of complaint to the date of finding or other disposition is just under 11 
months. We might take some comfort from that, but it is uncomfortably close 

to the outside limit, and closer examination of the tables shows that the average 
time elapsed for some categories has exceeded the limit. In fact, the breakdown by 
finding/disposition shows that complaints that require full investigation — that is, 
the complaints that are “well-founded,” “not well-founded” or “resolved” — take on 
average more than a year to complete. (The delay in completing complaints where 
the finding is “no jurisdiction” reflects the complex factual and legal issues that must 
be addressed. Where jurisdiction is clearly not ours, the complaint does not get past 
our inquiries officers. If a complaint involving a jurisdictional issue has made it to 
the investigation phase, it is because the jurisdictional issue is not straightforward.) 
The length of time it is taking us to complete investigations can be attributed to a 
number of factors, including changes in procedures and resource issues. Whatever 
the reasons, it remains a matter of great concern to us, and we are focusing on 
ensuring that we process complaints within the period envisaged under the Act. 


Inquiries 


The OPC’s Inquiries Unit responds to requests for information about the application 
of PIPEDA and the Privacy Act. The Office receives thousands of inquiries each year 
from the public and organizations seeking advice on private sector privacy issues. 


In 2005, the Office received 5,685 inquiries related to PIPEDA. This was less than 
half the number for 2004, when we received 12,132. The total for 2004 was in turn 
lower than for 2003. As we noted last year, the decline may be attributable to greater 
understanding of PIPEDA among the organizations subject to it. In 2003 and 2004, 
on the other hand, many organizations were searching for guidance about PIPEDA 
as the Act approached full implementation on January 1, 2004. 


The inquiries staff are now responding to fewer calls, but they are providing more 
information. An automated telephone system also helps to answer the public’s most 
frequently asked questions, such as those about identity theft, telemarketing and 
the Social Insurance Number. In addition, our web site provides a wide range of 
information and is increasingly used as a key resource. 
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Inquiries Statistics 
January 1 to December 31, 2005 


uiries Received by the Inquiries Unit 


Written inquiries (letter and fax) 


Written inquires (letter and fax) 


Following Up on PIPEDA Case Investigations | 


Since 2004, the Investigations and Inquiries Branch has as a matter of course 
monitored the progress of organizations in implementing both the commitments 
they make during complaint investigations and the recommendations that the Office 
makes to them in letters of findings. Follow-up reinforces the Office’s expectations 
that organizations will take measures to remedy problems identified in complaint 
investigations. It also provides an ongoing record of organizations’ compliance with 
PIPEDA: 


The following are a few examples of actions taken by organizations as a result of our 
recommendations: 


e An individual complained that his former employer was able to access his 
account with a rewards program and make changes to it. In her letter of 
finding, the Assistant Commissioner recommended to the organization now 
responsible for the rewards program that it implement password controls on 
the account holder information that can be accessed through its automated 
system. Our follow-up confirmed that the organization had introduced 
voice print technology and password protection for access to account holder 


information. 
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e An individual was disputing an auto insurance claim against her and 
sought various documents, including the claimant’s statement. The 
insurance company refused to release the statement without the claimant’s 
consent. The Assistant Commissioner recommended that the company 
sever the personal information of the third party claimant and provide 
the complainant with access to her personal information. She also 
recommended that the adjusters who work on the insurer’s behalf notify 
third party claimants that their statements to the insurer will be shared 
with the insured person upon request, and that, for the purposes of 
providing access, only the personal information of the third party claimant 
that is not directly related to the statement to the insurer be severed from 
the statement. Our follow-up confirmed that the company did give the 
complainant a copy of the statement, with the relevant personal information 
of the claimant severed, and that the company had implemented our 
recommendations about its practices. 


e An individual complained when his bank refused to allow him to opt-out of 
receiving marketing materials that were included in his credit card account 
statements. These materials, or “statement stuffers,” were advertisements for 
various products and services, such as magazines or travel insurance, and 
were being offered by the bank in conjunction with other organizations. In 
response to the Assistant Commissioner’s recommendations, the bank has 
implemented a procedure for customers to opt-out of receiving secondary 
marketing inserts. 


e A former employee of an aviation company complained that his employer 
inappropriately destroyed his employment file. The Assistant Commissioner 
concluded that the complainant’s file had been destroyed in accordance 
with the Canadian Aviation Regulations, and that the complaint was not 
well-founded. Nonetheless, she recommended that the company specify its 
maximum retention period for these files, and keep a record of when and 
by whom files are destroyed. Our follow-up confirmed that the aviation 
company amended its internal directives to specify the minimum and 
maximum period for retention of a pilot’s file, and also instituted a log to 
indicate when and by whom files are destroyed. 


e An individual complained that her Internet service provider failed to protect 
her personal information adequately, did not provide her with a satisfactory 
explanation when she tried to resolve her concerns, and did not give her 
access to the personal information she had requested. The investigation 
did not support the allegations about failure to protect her personal 
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information, and the access complaint was resolved during investigation. 
On the accountability issue, the Assistant Commissioner recommended that 
the company implement a procedure for outstanding privacy concerns to be 
brought to the attention of the company’s privacy officer. The organization 
already had such a procedure, but acknowledged that its staff required 
greater awareness of and sensitivity to privacy. It undertook to provide the 
necessary training. 


An individual complained about a bank using his personal information 

for marketing purposes. The Assistant Commissioner concluded that 

the complaint was not well-founded, because the complainant had not 
requested that his name be suppressed from marketing lists. In reviewing 
the bank’s privacy policy, however, she noted that it required customers 

to obtain and complete a form to have their names suppressed from the 
bank’s marketing lists. She commented that this did not meet the reasonable 
expectations of most individuals — namely, that an immediate, easy and 
inexpensive means of withdrawing consent to the optional collection, use 
and disclosure of their personal information be provided. She therefore 
recommended that the bank review its opt-out procedures. In response, the 
bank amended its policy and procedures on direct marketing preferences. 
Clients wanting to opt-out of the use of their personal information for 
secondary marketing purposes can now simply contact any branch of the 
bank or the bank’s call centre. 
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Investigation process under PIPEDA 


Inquiry: — _ 

Individual contacts OPC by letter, by telephone, or in person to complain of vi 
or ayy telephone must subsequently submit their allegations in writin _ 
Initial analysis: 


Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


lation of Act Individuals who make contact in person 


An individual may complain about any matter specified in sections 5 to 10 of the Act or in Schedule 1 — for example, denial of 
access, or unacceptable delay in providing access, to his or her personal information held by an organization; improper collection, 
use or disclosure of personal information; inaccuracies in personal information oe or disclosed 4 an oan 1; OF ir 
safeguards of an organization's holdings of personal information. _ 


v % 
rere Complaint? ain ula 
No: : Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


Investigation: 
The investigation provides the ec basis for the Commissioner to determine whether 
the individuals rights have been contravened under PIPEDA. 


Early resolution? 
A complaint may be resolved 
before an investigation is 
undertaken if, for example, the 


t i 
1 1 
t i] 
t 1 
t 1 
i} 1 
t i : 
tL 1 The investigator writes to the organization, outlining the substance of the complaint. 
' issue has already been fully 
t 1 
t 1 
t 1 
t 1 


The investigator gathers the facts related to the complaint through representations from 
both parties and through independent inquiry, interviews of witnesses, and review of 
documentation. Through the Privacy Commissioner or her delegate, the investigator has 
the authority to receive evidence, enter premises where appropriate, and examine or 

Ft rd bees Lae — oe copies of records found on any premises. — _ 


dealt with in another complaint 
and the organization has ceased 
the practice. 


1 
ARES LD i» AE ; ! 
Discontinued? ss; ! Analysis (on next page) 
: Acomplaint may be discontinued 
if, forexample,acomplainant —} 
‘ decides not topursueit,ora 
‘ complainant cannot be located. 4 oy, 
Cosel 2 Settled? (on next ee wee e een n nee 


Note: a broken line (- - - - ) indicates a possible outcome. 
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Analysis: 
The investigator analyses the facts and prepares recommendations to the Privacy Commissioner or her delegate. The investigator 
will contact the parties and review the facts gathered during the course of the investigation. The investigator will also tell the parties 
what he or she will be recommending, based on the facts, to the Privacy Commissioner or her — At this point, the parties may 
make further representations. 


Anais will include internal cnstatons with, for example lea Services or oe and Policy Branches, as appropriate. 


i] 

: Cf Findings: | 
the Privacy Commoner or her delegate reviews the file and assesses the report. The Prec 

: Commissioner or her delegate, not the investigator, decides what the appropriate outcome should 


oe ae a a be and whether recommendations to the ra are warranted. 
‘The OPCseeksto A 
oe oe ‘ _ _ Preliminary report 
—— 3 Its of the nvestigation indicate to the Privacy Commissioner or her delegate that there likely 
ae | con ravention of PIPEDA, she or her delegate recommends to the organization how to remedy 
- coer ; ization to indicate within a set time- period how it will implement the 
t 2a 
| encourages a | 
t d 
i resolution through ' ae 
‘mediation, = 
‘negotiation and 
' persuasion. The : 
‘ investigator assists ' 
iin this oe a 
‘_ ; 
; the letter of findings, the ay Commissioner o or he delat informs the complainant of his or her 
rights aire recou se to ons Federal Cou rt _ 
: s i . 
~~. ete eee tess Ll Ee Rie Oot AL 
eam mamma emery names ; ' The complainant orthe Privacy Commissioner may choose to apply to the Federal 


t ' Where recommendations have 
been made to an organization, oPc 
staff will follow up to verify that 

] _ they have been implemented. 


1 

; 7 Court fora hearing of the matter. The Federal Court has the power to order the 
--- >! organization to correct its practices and to publish a notice of any action taken or 
t 1 proposed to correct its practices. The Court can award damages to a complainant, 
1 ' including damages for humiliation. There is no ceiling on the amount of damages. 


Note: a broken line (- - - - ) indicates a possible outcome. 
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he goal of the Audit and Review Branch is to conduct independent and 

objective audits and reviews of personal information management systems 

for the purpose of promoting compliance with applicable legislation, 
policies and standards and improving privacy practices and accountability. 


Section 18(1) of PIPEDA allows the Commissioner, after giving reasonable notice 
and at any reasonable time, to audit the personal information management practices 
of an organization if the Commissioner has reasonable grounds to believe that the 
organization is contravening a provision of PIPEDA. 


Given the magnitude of privacy issues and risks now facing Canadians, audit must 
become more central to the activities of the Office, and more proactive. We are 
carefully developing criteria for determining the reasonable grounds for conducting 
an audit. We plan to make these criteria publicly available in July 2006. 


As well, as part of the upcoming review of PIPEDA, we are considering seeking 
amendments that would give the Privacy Commissioner the discretion to visit 
private sector entities and review their privacy management framework and 
practices to ensure that significant privacy risks are being identified and managed, 
even when a privacy breach has not become public. We believe that this discretion 
should also be used in particular when a significant privacy breach comes to light 
and the Commissioner decides that independent assurance is required that the 
organization concerned has taken appropriate corrective action. Such action would 
include critical diagnosis of internal systems and practices to remedy root causes and 
avoid future problems. 
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At the same time, we wish to support measures to encourage and help organizations 
to “self-regulate” and take responsibility for their own privacy governance and 
management. This is why, for example, we are developing a privacy self-assessment 
tool. 


Radio Frequency Identification Device (RFID) UseinCanada 


This year, the Audit and Review Branch conducted a study of a technology that 
is causing considerable concern from a privacy perspective — radio frequency 
identification devices, or RFIDs. 


RFIDs form a subset of a group of technologies, often referred to as automatic 
identification, that are used to help machines identify objects. An RFID “tag” can be 
placed in just about anything that is sold to, or used by, people. This includes bank 
cards, credit cards, money, passports, luggage, badges and wrist bands, clothing, 
vehicles and vehicle parts, appliances, phones, drugs, and food packaging. RFIDs 
can be implanted in livestock, and at least one company is advertising them for 
implanting in humans. Perhaps of greatest significance, RFIDs are capable of 
uniquely identifying a product. 


The small size of the tags and their ability to uniquely identify an object may pose 
various threats to individual privacy, including the following: 


e Surreptitious collection of information. RFID “tags” are small and can be 
embedded into/onto objects and documents without the knowledge of the 
individual who obtains those items. Tags can be read from a distance, by 
readers that can be incorporated invisibly into nearly any environment. 
Without clear notification, it may not be readily apparent that RFID 
technology is in use, making it virtually impossible for a person to know 
when or if he or she is being “scanned.” 


e = Tracking an individual’s movements. If RFID tags are embedded in clothing 
or vehicles, for example, and if there is a sufficiently dense network of 
readers in place, it becomes possible to track those tags in time and space. 
Applications to do just this, using a combination of RFID and Global 
Positioning System (GPS) technology, are being proposed by RFID vendors. 
If the tags can then be associated with an individual, then by that association 
the individual’s movements can be tracked. For example, a tag embedded 
in an article of clothing could serve as a de facto identifier for the person 
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wearing it. Even if information about the tagged item remains generic, 
identifying items people wear or carry could associate them with particular 
events — for example, political rallies or protests. 


e Profiling of individuals. When using bar codes, one bottle of water has 
the same barcode as all other bottles of water of that particular brand. 
RFID technology potentially enables every object on earth to have its own 
unique ID (i.e., each bottle of water would have a unique identifier). There 
is, perhaps, the risk that the use of unique ID numbers could lead to the 
creation of a global item registration system in which physical objects 
are identified and linked to its purchaser or owner at the point of sale 
or transfer. If these unique identifiers are associated with an individual 
(by linking through a credit card number, for example), a profile of that 
individual’s purchasing habits can easily be created. 


e Secondary use (particularly in the sense of limiting or controlling such 
use). For example, the revelation of personal information such as medical 
prescription or personal health histories could have an impact on insurance 
or employment. 


RFIDsin Canada __ 


Early in 2005 we wrote to 14 corporations in Canada asking them to help us 
understand the emerging use of RFIDs in Canada. 


Twelve responded to the survey we sent them. The survey was not intended as a 
statistically representative sample of Canadian businesses as a whole. Instead, the 
focus was on larger corporations whose business activities were most likely to use 
RFID technology. The organizations included those in manufacturing, retailing, 
transportation, and distribution, as well as those directly involved in manufacturing 
RFIDs. A standard survey letter was sent to each organization asking for information 
about current or planned RFID use. 


Of the 12 organizations that responded, two were involved in the production of 
RFIDs. Of the remaining ten, two were considering RFIDs, four had or would be 
testing RFID use, and four were using RFIDs already. 


Of the four already using them, three used them to track goods, and two indicated 
that they linked this with personal information. One organization was using RFIDs 
to track employees, but stated that it was not collecting personal information. 
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Six of the ten organizations responded in some way to the privacy issues mentioned 
in the survey letter. Of the six, one indicated that it would conduct a privacy impact 
assessment (PIA) in reviewing the possible use of RFIDs, one would not, two others 
might consider a PIA or privacy compliance test in their consideration of RFIDs, and 
two reported that they believed a PIA was not required, since their RFID application 
did not identify individuals and/or link with personal information. 


We learned that one central player in the RFID industry sets standards to enable and 
support RFID use. It also requires subscribers to respect certain privacy principles. 
For example, consumers must be notified of the presence of an RFID tag in an item 
and be given the choice to end the tag’s function (“kill” the tag) after purchasing the 
item. As well, the tags are not to contain personal information. We are encouraged by 
this attention to privacy, and we call for similarly responsible practices by all those in 
Canada who may use RFIDs. 


The only key government application for RFID of which we are now aware is its 
planned use in Canadian passports. We are monitoring this. As well, a group in 
Industry Canada is supporting and facilitating the development of commercial RFID 
technology. 


Need for RFID Awareness and Guidance 


Even at this early stage, RFID has expanded beyond simply tracking materials. RFIDs 
are already being linked to personal information, and are sometimes used to track 
people. 


Comprehensive privacy risk management for RFIDs does not yet seem to be firmly 
in place. Perhaps this is because RFIDs use is only beginning, with companies 
merely considering their business case for RFIDs, while RFID manufacturers are 
still focused on technical matters such as common standards to ensure security, 
compatibility and interoperability. 


Greater public and political awareness of the potentially intrusive nature of RFID 
technology is essential now. The OPC will develop guidelines to help ensure that, 
even as RFIDs become more common, they do not erode informational privacy 
rights. 
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Follow-up Audit of the Canadian Imperial Bank of Commerce 


Between 2001 and 2004, the Canadian Imperial Bank of Commerce (CIBC) 
misdirected a number of facsimiles containing customers’ personal information. 
Our Office investigated and identified concerns about privacy protection safeguards 
within the CIBC. In March 2005, we reported the results of this investigation to 

the CIBC. In light of other investigations into similar cases, we also publicly urged 
all banking organizations subject to PIPEDA to assess their policies and privacy 
management practices and address any shortcomings. 


CIBC then reported on a number of measures to identify problems and to enhance 
its personal information safeguards. It also conducted an internal audit. 


In a March 2005 letter to CIBC, we explained that representatives of our Audit and 
Review Branch would visit CIBC to verify the corrective actions that CIBC has taken 
and to discuss any other risks to personal information. In December 2005, we wrote 
CIBC that we would start this process in March 2006. We invited CIBC to send 
information in advance of our site visit to explain corrective actions taken by CIBC. 
We said that we would consider the results of the work done by the bank’s internal 
audit department in August 2005, as well as actions taken by bank management in 
response. 


A few weeks later, CIBC suggested meeting before our audit to confirm its scope and 
to understand the audit process. As requested, it agreed to give the Office a chance 
to examine the materials assembled in preparation for the review. We appreciate this 
level of cooperation. Results of our follow-up audit will appear in next year’s annual 
report. 


Privacy Self-assessment _ 


In our last annual report we noted that we were developing a privacy self-assessment 
tool for organizations to adapt and use as they wish. A draft is now being finalized 
with the help of internal and external expertise. The self-assessment tool is intended 
to promote good privacy practices and help ensure compliance with PIPEDA. It may 
also be of general interest to any entity wishing to advance privacy principles. We 
hope to publish the self-assessment tool in July 2006. 
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PIPEDA Applications 


nder sections 14 and 15 of PIPEDA, a complainant or the Commissioner 
| | herself may in certain circumstances apply to the Federal Court of 
Canada for a hearing in respect of any matter which is referred to in the 
Commissioner’s report and which falls within those specific clauses and sections of 


PIPEDA listed in section 14. 


Since we reported on the status of ongoing court cases in our 2004 PIPEDA Annual 
Report, further developments have occurred and new applications have been filed. A 
selection follows of PIPEDA developments and new applications from 2005. 


In keeping with our mandate, we have chosen not to reproduce the official style of 
cause in order to respect the privacy of the individual complainants. We are listing 
the court docket number and the name of the organization only. 


Developments in Ongoing Applications _ 


ns 
Federal Court Files T-1862- 04, T-1863- 04, T1864- 04 and T-1865- 04 
Federal Court of Appeal File No. A-639- 05. 


(See 2004 PIPEDA Annual Report at pages 85-86.) 


A hearing was held in Vancouver in September 2005. On November 29, 2005, Mr. 
Justice Gibson released his decision. He found that: (1) the Telecommunications 
Workers Union was not a proper party to the proceedings (i.e. it was not “an 
individual” entitled to apply to the Court); (2) the collection of the voice print 
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information at issue would be seen by a reasonable person to be appropriate in the 
circumstances pursuant to section 5(3) of the Act; and (3) Telus met its consent 
obligations under the Act. 


The applicants filed an appeal on December 22, 2005. 


Alta Flights (Charters) Inc. 
Federal Court File No. T-1066-04 
- Federal Court of Appeal File No. A-184-05 


(See our 2004 PIPEDA Annual Report at pages 84-85.) 


The application was heard on March 15, 2005, and the decision released on March 
29. The Court concluded, as had the Assistant Privacy Commissioner, that since 
there was no evidence that Alta Flights had recorded any conversations, the company 
did not actually manage to collect and/or use any personal information. In the 
absence of any explicit or implicit statutory language, common law principles of 
attempted breach cannot be read into PIPEDA. The Court therefore found that an 
attempted collection does not violate the Act. 


The applicant filed an appeal of the decision in April 2005. A requisition for hearing of 
the appeal was filed on August 4, 2005 and the hearing date was set for March 21, 2006. 


New Applications of Interest 


Brampton Flying Club 
Federal Court File No. T-192-05 


The complainant was the long-time general manager of the Brampton Flying Club 
(BFC) until dismissed from his position. He took legal action regarding his dismissal 
and also made an access request for a copy of all his personal information held by 
the club. 


In December 2003, he complained to the Privacy Commissioner that BFC had (1) 
failed to provide him with his personal information within 30 days of his written 
request; (2) subsequently tried to charge him an unreasonable amount of $1,500 to 
conduct a five-day forensic audit which BFC claimed would be necessary to answer 
his request; and (3) still had not supplied him with all his information. 
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The Assistant Commissioner determined that the statutory time limit in section 
8(3) had been exceeded, that the $1,500 charge was beyond the scope of “minimal 
or no cost” set out in Principle 4.9.4, and that some of the complainant’s personal 
information was improperly withheld by the organization. 


The individual filed an application to the Federal Court under section 14 of PIPEDA 
on February 3, 2005. The Privacy Commissioner was added as a party to this 
application on May 18, 2005. 


The Privacy Commissioner took the position that fact that the complainant may 
have been seeking access to documents that might assist him in parallel court 
proceedings between the parties was irrelevant. A complainant’s motive should not 
be used to limit his or her right of access to personal information under PIPEDA. In 
these unique circumstances, the Privacy Commissioner filed a confidential affidavit 
with the Court to identify the documents to which the complainant was seeking 
access and which had been withheld by the organization. 


The matter was adjourned for 60 days on January 3, 2006, to allow for settlement 
discussions. 


Jeffrey P. Wyndowe 
Federal Court File No. T-711-05 


The complainant alleged that Dr. Wyndowe, an independent medical examiner who 
examined the complainant on behalf of his insurance company, refused to provide 
him with access to his personal information. The complainant asked for a copy of 
the questions the doctor asked him, as well as a record of his answers. Dr. Wyndowe 
refused, indicating that in his view they did not form part of the complainant's 
medical record and were therefore not his personal information. 


The Assistant Commissioner found that the notes taken by Dr. Wyndowe in support 
of his report were the complainant’s personal information as defined in section 2 of 
PIPEDA. Dr. Wyndowe then argued that the independent medical examination took 
place in the context of a litigious situation, and that access could therefore be denied 
because the information was protected by solicitor-client privilege. The Assistant 
Commissioner did not accept this interpretation of section 9(3)(a) of PIPEDA, 
since Dr. Wyndowe had not been retained by the insurance company as an expert 

in the context of ongoing litigation; rather, he was retained as an expert to help the 
company determine its obligations under a group insurance policy. 
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Nor was the Assistant Commissioner convinced that section 9(3)(d) — which 
permits an organization to deny access to information generated in the course of a 
formal dispute resolution process — could be used in this case, since processing the 
insurance claim did not constitute a formal dispute resolution process. 


The Assistant Commissioner recommended that Dr. Wyndowe provide the 
complainant with access to his personal information. 


The complainant filed an application to the Federal Court under section 14 of 
PIPEDA on April 25, 2005. The Privacy Commissioner was added as a party on 
July 7, 2005. A requisition for hearing was filed on October 3, 2005, although no 
date has yet been set. 


Scotiabank . oe _ 
Federal Court File No. T-2126-05 — 


An individual complained that one or more employees of Scotiabank obtained 
her personal information without her consent, and that this information was then 
communicated to a third party. 


During the investigation, it was confirmed that one of the bank’s employees had 
improperly accessed the applicant’s account profile without her consent, and had 
provided this information to the director of the branch, but not to any outside party. 
The bank had already taken disciplinary measures against this employee following its 
own internal investigation. 


The Assistant Commissioner concluded that the bank employee had indeed violated 
the provisions of PIPEDA and that the complaint was well-founded. 


The complainant filed an application to the Federal Court under section 14 of 
PIPEDA on December 1, 2005. The matter is proceeding before Federal Court. 


Privacy Commissioner of Canada v. RBC Action Direct Inc. 
Federal Court File No. 05-T-17. 


An individual complained that RBC Action Direct refused to release to him all 
his personal information in response to an access request made under PIPEDA. 
The information included a transcript of the complainant giving instructions by 
telephone to an RBC Action Direct representative regarding an account which he 
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claimed to be a joint account between him and a third party. The organization 
contended that the information was the personal information only of the third party 
account holder, not that of the complainant, and withheld the transcript. 


The Assistant Privacy Commissioner concluded that information may be personal 
to more than one party. In this case, there was personal information of the third- 
party account holder but the transcript capturing the complainant’s telephone 
conversation with the organization’s representative also constituted the personal 
information of the complainant. Accordingly, the complaint was well-founded 

and the Assistant Commissioner recommended that the organization release the 
transcript to the complainant. Though RBC Action Direct provided the complainant 
with a copy of the transcript, it severed virtually all the information in it, 
maintaining — despite the Commissioner’s finding — that it was the account holder’s 
personal information only. 


As more than 45 days had lapsed since the issuance of the Commissioner’s report, 
the Commissioner requested an extension of time to file a section 15(a) application 
in Federal Court against RBC Action Direct Inc. Leave to file the application was 
granted on December 16, 2005. 


Applications No Longer Proceeding 


An individual complained that a nurse affiliated with CN shared his personal 
information when she revealed to his supervisor sufficient information for the 
supervisor to deduce that the complainant was in the company’s substance abuse 
program, and that she disclosed further personal information about him in an email 
to the supervisor, superintendent and two other CN supervisors. 


The Assistant Privacy Commissioner concluded that the nurse had indeed revealed 
too much personal information in both instances, and that the information was 
not necessary in the circumstances. CN therefore inappropriately used his personal 
information and violated Principle 4.3. 


The complainant filed an application in the Federal Court under section 14 of 
PIPEDA on May 14, 2004. The Privacy Commissioner was added as a party in 
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October 2004 in order to make arguments concerning: (1) the scope of the Privacy 
Commissioner’s jurisdiction and that of the Federal Court over PIPEDA complaints 
that arise in the context of a collective agreement; and (2) the proper interpretation 
of section 5(3) and Principle 4.3 of PIPEDA. 


The Application was discontinued on June 8, 2005. 


3web Corporation 
Federal Court File No. T- 1603-04 


(See our 2004 PIPEDA Annual Report at pages 88-89.) 


The company discontinued the proceeding in June 2005. 


Calm Air International Ltd. 
Federal Court File No. T-2061-04 


(See our 2004 PIPEDA Annual Report at page 87.) 


The Privacy Commissioner was added as a party on October 24, 2005. On November 
18, 2005, the parties reached a settlement at mediation. The application was 
dismissed on January 20, 2006. 


Citibank Canada 
Federal Court File No. T-2135-04 


(See our 2004 PIPEDA Annual Report at page 86.) 


An application under section 14 of PIPEDA was filed in the Federal Court on 
December 1, 2004. A settlement was reached at mediation. The application was 
dismissed on June 15, 2005. 


King Cole Ducks Limited 
Federal Court File No. T-445-05 


A Canadian Food Inspection Agency employee, working at a federally registered 
meat processing plant, complained that the organization was collecting personal 
information without consent through video cameras aimed at his workstation. 

The company stated that the cameras could help it address food safety concerns. 
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However, there was no evidence that the cameras could capture sufficiently detailed 
images to do this effectively. The Assistant Privacy Commissioner concluded that the 
organization was indeed collecting the complainant’s personal information without 
his consent, contrary to Principle 4.3, for purposes which, upon closer examination, 
would not likely be considered appropriate in the circumstances pursuant to section 
5(3) of PIPEDA. 


The complainant filed an application to the Federal Court under section 14 of 
PIPEDA on March 9, 2005, requesting, among other things, an order that the 
organization remove the surveillance camera aimed at his workstation. This 
application was discontinued on November 4, 2005. 


Judicial Review | 


There were two applications, in accordance with section 18.1 of the Federal Court 
Act, for judicial review of the Privacy Commissioner’s decisions and/or actions on 
the limited grounds of jurisdictional-type errors. 


Blood Tribe Department of Health v. ses) Commissioner of Canada et al. 
Federal Court File No. S 222- 03 


(See our 2004 PIPEDA Annual Report at pages 87-88.) 


The Federal Court dismissed this judicial review application on its merits in March 
2005. At that time, Mr. Justice Mosley stated that when the Privacy Commissioner 
is seized with a complaint over the retention and use of personal information, she 
has the responsibility to determine the facts and the duty to prepare a report of 
her findings. She cannot perform that role effectively if she is denied access to the 
information necessary to ascertain the facts merely because a claim of privilege is 
made. The Court was satisfied that the Commissioner had correctly exercised her 
authority to order the respondent to give her the documents in question, so that 
the Commissioner might herself assess the claim of solicitor-client privilege. Given 
the Commissioner’s statutory obligation of confidentiality, such an order does not 
otherwise limit or deny any solicitor-client privilege that the applicant might enjoy 
in the documents at issue. 


The applicant filed an appeal of this decision in April 2005. A requisition for hearing 
was filed in September 2005, but no date for a hearing has yet been set. 
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Accusearch Inc., COB Abika.com 
Federal Court File No. T-2228-05 


A complaint was filed against a data search and profiling organization in the 

United States. The Privacy Commissioner determined that, to investigate the U.S. 
organization, she must have the requisite legislative authority to exercise her powers 
outside Canada. The Commissioner concluded that PIPEDA cannot be construed as 
_having extraterritorial effect. Based on available information, there were insufficient 
real and substantial connecting factors between the organization and Canada to 
deem the organization within the current scope of PIPEDA. In the circumstances, 
the applicant was informed that the Privacy Commissioner could not proceed with 
the complaint, as she lacked jurisdiction to compel the organization to produce 
evidence necessary for her to carry out an investigation and issue findings. 


The applicant filed an application under section 18.1 of the Federal Court Act 
on December 19, 2005, seeking an order quashing or setting aside the Privacy 
Commissioner’s decision that she lacks jurisdiction to investigate the complaint. 


a2 


ection 24 of PIPEDA gives the Privacy Commissioner a specific mandate 


for public education and communications, as well as for research into 
privacy issues. 


The Act requires the Commissioner to: 


(a) develop and conduct information programs to foster public 
understanding, and recognition of the purposes, of Part 1 of PIPEDA, 
which deals with personal information protection in the private sector; 

(b) undertake and publish research that is related to the protection of 
personal information, including any such research that is requested by 
the Minister of Industry; 

(c) encourage organizations to develop detailed policies and practices, 
including organizational codes of practice, to comply with sections 5 to 
10; and 

(d) promote, by any means that the Commissioner considers appropriate, 
the purposes of Part 1. 


In 2005, the OPC took several steps to gain a better understanding of Canadians’ 
views on privacy issues, to raise awareness and understanding of privacy in general 
and, specifically, to help organizations understand their responsibilities, and 
individuals their rights, under PIPEDA. This has involved, for example, undertaking 
public opinion research, media relations activities, speeches and participation in 
special events and conferences, the printing and dissemination of publications, and 
posting information on our web site. 
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Public Opinion Research 


This year, the OPC commissioned EKOS Research Associates to conduct a public 
opinion study about Canadians’ views on a variety of important privacy issues. 


Canadians support strong and responsive public and private sector privacy laws. 
Approximately 70 per cent of those surveyed expressed a strong sense that their 
privacy and protection of their personal information were being eroded. They 
identified privacy as among the most important issues facing the country. That said, 
however, a gap remained between the perceived importance of privacy and privacy 
laws, and public awareness about these matters. Only one in five of those surveyed 
expressed “clear” awareness of privacy laws, so much education remains to be done. 


There was an extremely high level of concern about cross-border sharing of personal 
information, and a strong demand for consent as a condition for such sharing. 
Approximately 90 per cent of those surveyed wished not only to be informed of such 
sharing, but also insisted that governments and the private sector first obtain their 
permission. The Government has since developed guidelines to ensure that personal 
information is protected when government contracts involve outsourcing — one step 
in the right direction. 


A substantial majority of those surveyed said there was no real privacy because 
technology has made it too easy for governments to keep track of people. Although 
about three in ten were willing to allow companies to track how they shop in return 
for a discount on products or services, the vast majority of those surveyed wanted to 
be notified about the privacy implications of the products and services they buy. 


Speeches and Special Events 


Conferences, meetings and other special events offer a unique opportunity for 
the OPC to reach out to its audiences and make significant contributions to the 
protection of personal information in Canada and abroad. 


Our Office hosts a regular in-house lecture series (roughly one a month). The series 
features experts on a variety of privacy issues and brings together people from 
government, academia and other invited guests, as well as our staff. 


In addition, representatives from our Office made more than fifty presentations in 
2005, several focusing on PIPEDA. For example, in the Northwest Territories we 
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provided guidance on PIPEDA’s application to the tourism industry, and at an event 
in Toronto we explained PIPEDA to the bookkeeping industry. At a technology 
industry conference in Banff, we explained the importance of privacy standards. 


The Privacy Commissioner and other senior officials also participated in a select 
number of international meetings and conferences. It is important that we 
participate in these meetings to establish Canada’s position on privacy issues abroad 
and to help represent Canada’s interest in strong privacy standards internationally, 
so that the personal information of Canadians processed in other countries is 

not compromised by lower privacy standards there. This has involved our Office 
participating in international data protection conferences, and meetings of the 
Asia-Pacific Economic Cooperation (APEC) and the Organisation for Economic 
Co-operation and Development (OECD). Our web site features some of the recent 
resolutions adopted by the data protection and privacy commissioners at their 2005 
international conference in Montreux, Switzerland. This annual conference is an 
important event for the evolution of common approaches and the debate on global 
challenges to privacy, and we are honoured to be hosting the meeting in Montreal in 
2007. 


Publications 


Each year, the OPC produces and disseminates thousands of copies of publications 
to individuals and organizations seeking information on privacy matters. 
Increasingly, Canadians are viewing these documents on our web site. These 
documents include annual reports, guides for businesses and individuals about 
PIPEDA, as well as fact sheets and copies of both PIPEDA and the Privacy Act. 


In 2005, we also published a new educational document — Learning from a Decade 
of Experience: Quebec’s Private Sector Privacy Act — which aims to review and 
summarize Quebec’s experience with its private sector law, which has been in force 
since 1994. 


Quebec has had more than a decade of experience interpreting and applying its 
Act in numerous sectors and multiple situations. This has resulted in a rich body of 
jurisprudence that provides important insights for other jurisdictions dealing with 
private sector privacy compliance. We have heard that this publication has been 
extremely useful in helping to interpret PIPEDA and similar laws. 
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WebSites eM 


The OPC web site has seen a steady and significant increase in visits over the last 
several years. As with other organizations, our web site has become a key vehicle for 
sharing information with broad audiences. We are pleased to report that in 2005 we 
had almost a million visitors to our site — a milestone for our Office. We regularly 
post new material. This includes speeches, fact sheets, news releases, useful links and 
case summaries under PIPEDA. These materials give a real sense of the application 
of the law in a variety of circumstances. 


Although public education and communications are an important part of our 
mandate, limited financial and human resources have constrained our ability to 
go much beyond simply responding to issues, rather than anticipating them and 
preparing public education strategies in advance. However, expected increased 
funding will permit more extensive public awareness initiatives and enable us to 
carry out a comprehensive proactive communications and outreach strategy. 
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uring 2005, the main priority of the Corporate Services Branch was 
completing the business case for stable, long-term funding. The second 


priority was strengthening our human resources management capacity. 


Planning and Reporting | 


An essential component of the institutional renewal of our Office is a strategic 
planning, reporting and control process. The year 2005 was our second using this 
new process. The strategic plan established at the beginning of the year became 
our road map for the year. We reviewed and made adjustments to plans and 
budgets throughout the year. To assist in our reporting, we continued work on 
our Performance Measurement Framework, and our monthly performance report 
system has now been in place for 18 months. This serves as a critical management 
tool for measuring whether our results meet our Office’s targets. 


Human Resources | 


We continue trying to improve workplace quality and Office operations. Significant 
changes and improvements have been made to human resources management 
policies and practices. 


We have implemented several human resource policies in consultation with 
central agencies and unions and in line with the new Public Service Employment 
Act requirements. These policies will guide us as we build on the successes of the 
past year and continue on our path towards renewing the Office. An Instrument 
of Delegation of Human Resource Management was developed and will guide 
managers in addressing human resource issues. A new Strategic Human Resource 
Plan and Staffing Strategy, as well as an Employment Equity Action Plan, will 
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help the OPC fulfill its mandate and ensure the recruitment of a highly qualified, 
diverse and representative workforce. As part of OPC’s commitment to increase 
transparency in the staffing processes, a staff newsletter was developed; it is 
distributed monthly to all members of staff. 


We made significant strides in organizational learning, including the development 
of a learning strategy with the Canada School of Public Service (CSPS), training 
and information sessions in values-based staffing, language training sessions, 
performance management, employee appraisals, and harassment awareness in the 
workplace. We have provided briefing sessions at our quarterly all-staff meetings 
and to all managers on various aspects of the new Public Service Modernization Act 
and Public Service Employment Act. The learning strategy and curriculum with the 
CSPS enables staff members to continue to develop the expertise and competencies 
required in their work, which in turn positions staff to assume new responsibilities 
and accountabilities. The learning strategy has been modified to reflect training 
requirements related to the new Public Service Employment Act. 


We continue to work with the Public Service Commission and the Public 

Service Human Resources Management Agency of Canada on responses to 
recommendations in their audit reports. These include measures to allow OPC to 
regain its full staffing delegation authority. 


Finance and Administration 


The OPC received a clean opinion on Audited 2004-2005 Financial Statements 

by the Office of the Auditor General of Canada. Along with the clean opinion for 
2003-2004, this is a very firm indication that the Office has advanced along the path 
of institutional renewal. The organization has built on this success by establishing 
planning and review cycles, and by streamlining and improving the financial 
management policies and practices. 


Information Management/Information (IM/IT) Technology 


The IM/IT Division has accomplished much over the past year. We have renewed 
our server infrastructure and increased data storage to allow for the scanning of 
documents. Substantial progress has been made on our information management 
project. Upgrades to our records management and correspondence tracking systems 
have been completed. Financial systems — the Salary Management System (SMS) and 
FreeBalance — have been upgraded, and the FreeBalance server has been upgraded 

as well. Five new tracking systems have been developed for the Audit and Review 
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Branch to allow the tracking of audit files. We have completed the Action Plan for 
Management of Information Technology Standards Compliance and we are working 
steadily towards the December 2006 compliance deadline. 


Our ResourceNeeds 


As described earlier in this report, the Office has completed a business process review 
of all OPC functions. Following that review we requested a greater than 50 per cent 
increase in resources. We are planning for an overall budget of approximately $18 
million and 140 full-time equivalents (FTEs), and for a shift in the distribution of 
new resources to enable the Office to become more proactive. 


Past annual reports of this Office have provided financial tables relating to our 
expenditures. The overall financial framework in which the OPC operates is based 
on the government fiscal year, not on the calendar year. We are required to report 
on PIPEDA for the calendar year, whereas for the Privacy Act, we report on the fiscal 
year. For this reason, and to avoid any confusion, we have not included our Office’s 
financial tables in this report. In any case, we set out these tables in our Reports 

on Plans and Priorities, as well as our Departmental Performance Reports. 

For additional financial information, we encourage you to visit our web site at 
WWW.Pprivcom.gc.ca. 
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June 2008 


The Honourable Noél A. Kinsella, Senator 
The Speaker 

The Senate of Canada 

Ottawa 
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Dear Mr. Speaker: 
I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 


Electronic Documents Act for the period from January 1 to December 31, 2007. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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The Honourable Peter Milliken, M.P. 
The Speaker 


The House of Commons 
Ottawa 
Dear Mr. Speaker: 
I have the honour to submit to Parliament the Annual Report of the Office 
of the Privacy Commissioner of Canada on the Personal Information Protection and 


Electronic Documents Act for the period from January 1 to December 31, 2007. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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MESSAGE FROM THE COMMISSIONER 


‘The year 2007 will no doubt be remembered in the privacy 
world as the year of the data breach. 


‘The size of some of the data spills reported around the globe 
was staggering: An estimated 94 million credit and debit cards 
were exposed when hackers broke into the system at TJX 
Companies Inc., the U.S. retail giant which owns Winners and 
HomeSense stores in Canada. In the United Kingdom, two 
computer discs holding the personal details of some 25 million 
child benefit recipients vanished. 


Those were only the two most high-profile data security disasters. Scores of other major 
data breaches affecting millions of people around the world were also reported. 


Data breaches here in Canada kept our team extraordinarily busy in 2007. 


Of particular note, we investigated the TJX/Winners breach, as well as the 
disappearance of a hard drive containing the personal information of close to half a 
million clients of Talvest Mutual Funds, a subsidiary of the Canadian Imperial Bank of 
Commerce (CIBC). 


An Obligation for Business 
It’s clear that organizations of all sizes can — and must — do more to prevent data leaks. 


The Personal Information Protection and Electronic Documents Act (PIPEDA) imposes a 
legal obligation on businesses to adequately safeguard the personal data they collect. Too 
often, however, we see breaches occur as a result of human error or a cavalier approach to 
security. 


Our Office has been working with the business community in Canada to improve 
privacy practices and encourage the use of strong information technology safeguards. 
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Recent headlines about massive data breaches are also prompting some businesses to 
rethink how they handle privacy and security. No one wants to have to call clients to tell 
them that their personal information has been lost. 


I hope 2008 will mark a turning point in the protection of personal information. It is 
time for businesses to recognize that personal information is valuable — and it needs to 
be well protected. 


Unfortunately, the challenge of safeguarding personal information is greater than ever. 
The amount of personal data being collected, stored and shared is ever-growing — and so 
too is the ingenuity of fraudsters and hackers. 


A Busy Year 
Our Office will also remember 2007 as the year we: 


e Hosted the 29" International Conference of Data Protection and Privacy 
Commissioners; 


e Expanded our work in the international arena; 
e Contributed to efforts to improve PIPEDA, and 
e Welcomed a new Assistant Privacy Commissioner. 
A few thoughts on each of these key events and issues of the year... 


Hosting the Privacy World 


The success of the 29" International Conference of Data Protection and Privacy 
Commissioners — held in Montreal in September and following through on our initial 
2002 engagement — was beyond our highest expectations. 


We welcomed more than 600 commissioners, academics, privacy professionals, 
advocates, government officials, IT specialists and others from around the globe — 
making it the largest-ever conference of its kind. Most importantly, the positive reviews 
and kudos from participants justified the time and resources invested in this event. 


The conference theme was Privacy Horizons: Terra Incognita. Early cartographers 
marked unknown lands that had yet to be mapped with this Latin term. One of the 
earliest known terrestrial globes from Europe labels an uncharted edge of the ocean “hic 
sunt dracones” — or “here be dragons.” 


MESSAGE FROM THE COMMISSIONER 


‘This notion of an unknown landscape with lurking dragons seemed the perfect 
metaphor for the future of privacy. 


Privacy issues are changing rapidly, with powerful new technologies and the 
international war on terror acting as potent forces which threaten the privacy of people 
around the world. 


The goal of our conference was to begin to chart what the privacy world of the future 
might look like and also to equip privacy advocates with some strong dragon-slaying 
tools. 


During a series of plenaries, workshops and information sessions, we considered the best 
strategies for defending privacy rights in the face of constant change. 


Participants heard from the who’s who of the privacy world, including security 
technology guru and author Bruce Schneier; Simon Davies, a pioneer of the 
international privacy arena and founder of Privacy International; consumer privacy 
advocate Katherine Albrecht; Marc Rotenberg, executive director of the Electronic 
Privacy Information Center; Peter Fleischer, Google’s global privacy counsel; Peter 
Hustinx, the European Data Protection Supervisor; as well as Peter Schaar, now past- 


chair of the EU Article 29 Data Protection Working Party and France’s Alex Tiirk, who 


is now chair of the working party. 


Our guest of honour, on hand to help open the conference, was the Honourable Peter 


Milliken, Speaker of the House of Commons. 


Our keynote speaker was U.S. Homeland Security Secretary Michael Chertoff, who 
bluntly argued his thoughts on balancing privacy rights in the context of national 
security to a somewhat skeptical audience — and sparked plenty of discussion throughout 
the conference! 


A member of our external advisory committee, University of Ottawa law Professor 
Michael Geist, who holds the Canada Research Chair of Internet and E-commerce 
Law, later responded by describing Chertoff’s case for greater surveillance by 
governments to hundreds of privacy advocates as a “confrontational challenge.” 


“ ... His vision of a broad surveillance society — supported by massive databases of 
biometric data collected from hundreds of millions of people — presented a chilling 
future. Rather than serra incognita, Chertoff seemed to say there is a known reality about 
our future course and there is little that the privacy community can do about it,” Geist 
wrote in his popular blog. 
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Hopefully, Chertoff’s comments will serve as inspiration for privacy advocates to make 
an even stronger case for privacy rights in the post 9-11 world. 


The conference program underscored the wide range of issues which will have an impact 
on privacy in the coming years as well as the increasingly global nature of privacy issues. 


We prepared 14 workbooks before the conference. Most included a commissioned 
paper by a subject-matter expert and a variety of other resources, such as bibliographical 
materials, to satisfy the curiosity of participants who might be new to a particular 
subject, as well as the more rigorous requirements of key policy and decision-makers to 
locate trustworthy information about the privacy implications of our conference topics. 
‘These are available on our conference website at www.privacyconference2007.gc.ca and 
are an important legacy of the conference. 


We have posted details about the cost of the conference on our website. We stayed well 
within our overall financial targets. 


Feedback from conference participants was extremely positive. In fact, one of the few 
frustrations expressed by delegates was that there were too many sessions of interest 
occurring at the same time! 


A Global Concern 


‘The impact of globalization on privacy is a growing preoccupation of my Office. The fact 
that more and more personal information is crossing borders means data breaches often 
affect people in multiple countries — as we saw in the TJX/Winners case. The increasing 
popularity of the Internet also raises many cross-border issues with implications for our 


Office. 


I am pleased to report we are making progress in our work with international 
counterparts to find global privacy solutions. 


Resolutions adopted during the conference by data protection authorities from every 
continent recognized the increasingly global context of privacy issues. 


Commissioners called for international standards for the use and disclosure of personal 
information collected by travel carriers about passengers. They warned that the 

transfer of personal information from travel agents, carriers and domestic and foreign 
governments poses an ongoing threat to the personal privacy of passengers. A global 
solution needs to be developed with the cooperation of carriers, law enforcement 
agencies, international organizations, civil liberties groups, and data protection and 
privacy experts. 


MESSAGE FROM THE COMMISSIONER 


Data protection authorities adopted two other resolutions: to improve international 
cooperation; and to build upon the work of the International Standards Organization to 
establish shared privacy standards in the area of information technology. 


My Office has also been working on transborder issues as part of other international 
initiatives. 


OECD/APEC Efforts 


I was pleased to chair an Organisation for Economic Co-operation and Development 
(OECD) volunteer group examining ways to encourage cooperation between data 
protection authorities and other enforcement bodies with respect to cross-border 
complaints and cases arising from transborder data flows. 


The group produced a report summarizing the powers of enforcement authorities in 
OECD member countries and their ability to share information to facilitate cross- 
border cooperation. The report concluded that, despite differences in national laws, there 
is considerable scope for a more global and systematic approach to cross-border privacy 
law enforcement cooperation. In June 2007, the OECD adopted a recommendation on 
cross-border cooperation which was based on the work of the volunteer group. 


‘The volunteer group’s work will also be highlighted during a June 2008 OECD 
ministerial meeting in Korea, where the theme will be the future of the Internet 
economy. 


My Office has also contributed to the work of the Asia-Pacific Economic Cooperation 
(APEC) on privacy issues. 


Canada has been active in ensuring that core privacy values and principles are reflected 
in APEC data protection rules — an initiative that will be of clear benefit to Canadians 
given our increasing data flows with APEC member countries. Our work in 2007 
focused on exploring ways to implement an APEC Privacy Framework. 


PIPEDA Reform 


Here at home, we supported the work of a committee of MPs reviewing PIPEDA. 
Members of the House of Commons Standing Committee on Access to Information, 
Privacy and Ethics presented the federal government with 25 recommendations for 
fine-tuning PIPEDA. The recommendation which received the most attention was a call 
for mandatory data breach notification — a concept I strongly support. 
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In response, the federal government launched public consultations on PIPEDA reform 
late in the year, requesting input on the parameters of data breach notification and other 
issues. 


We appreciate these consultations and look forward to seeing changes to improve 
PIPEDA - and ensure even stronger privacy protection for Canadians. 


Welcoming an Assistant Commissioner 


I am very pleased that Elizabeth Denham, our new Assistant Privacy Commissioner, 
will help lead the search for innovative solutions to the significant privacy challenges 
Canada will be facing in the coming years. 


Before her appointment, Ms. Denham was Director of Research, Analysis and 
Stakeholder Relations in our Office. Previously, she had been the Director, Private 
Sector, in the Office of the Information and Privacy Commissioner of Alberta. 


Ms. Denham’s experience in developing relationships with stakeholders, her perspective 
formed by her work with provincial commissioners and her extensive expertise in the 
privacy field will undoubtedly be of enormous benefit to the OPC in the coming years. 
She will be responsible for PIPEDA, working alongside Raymond D’Aoust, Assistant 
Commissioner responsible for the Privacy Act. 


A Dedicated and Expert Team 


I would also like to acknowledge the very hard work of the dedicated team in my Office 
over this past year. Hosting a major international conference was a huge undertaking — 
on top of an already intense workload. I am also pleased that our Office is attracting a 
new generation of personal information experts. 


I offer my sincere thanks to all the employees of the Office of the Privacy Commissioner 
for their immense contribution to protecting the privacy rights of Canadians. 


Jennifer Stoddart 
Privacy Commissioner of Canada 


PRIVACY BY THE NUMBERS IN 2007 


Average number of P/PEDA inquiries per month: 

Average number of PIPEDA complaints received per month: 
Average number of P/PEDA investigations closed per month: 
Total investigations closed during the year: 

Parliamentary appearances: 

Number of bills/acts reviewed for privacy implications: 
Research activities commissioned: 

Speeches and presentations delivered: 

Media requests: 

Interviews provided: 

News releases issued: 

Publications distributed: 

Average hits to our website per month from Canada: 
Average hits to our website per month from other countries: 
Average hits to our blog per month: 

Legal opinions prepared: 

Litigation decisions on PIPEDA cases rendered: 

Litigation cases settled: 


Access to Information Act requests received and closed between 
April 2007, when we first became subject to the legislation, and 
the end of the calendar year (all within prescribed timelines): 


Privacy Act requests received and closed 
during the same period: 


92 
474 
301 

44 

2,043 
39,429 
86,155 
14,173 

82 
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NEW STRATEGIC PRIORITIES 


‘The constantly changing world of privacy issues means our Office must find ways to 
focus our efforts. In 2007 we identified four new strategic priorities which we believe 
represent some of the most significant threats to the privacy of people across Canada. 


These priorities — information technology; identity management; national security; and 
genetic information — will help guide our policy, research and investigative work over the 
next three years. 


Information Technology 


Information technology was an obvious choice for our list because virtually every current 
privacy issue and privacy complaint we receive contains an IT component. 


Information and communications technologies have become integral to our daily lives. 
Technological advances mean more and more personal information can be gathered, 
stored, analysed and potentially accessed from anywhere in the world. 


These developments provide undeniable benefits in terms of convenience and efficiency, 
but also carry great risks for privacy. Governments and businesses can now collect and 
use personal data on a scale that was until recently unimaginable. 


Our Office will continue to develop the capacity to assess the privacy impact of new 
technologies. We will also work to help Canadians understand and, where possible, 
mitigate those privacy impacts. 


We demonstrated in 2007 how our Office can make a difference in this area after 
identifying privacy concerns stemming from the integration of street-level photography 
with web-based mapping technology. This type of photography involves the use of high- 
resolution video cameras, often affixed to vehicles as they drive along city streets. The 
images — including images of people who may be identified — are then made available on 
the Internet. 
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It has become something of an Internet sport to find pictures of people captured in 
embarrassing or personal moments — a man leaving an adult video store or young 
women sunbathing, for example — and then share them on websites. 


Google’s Street View is one of several services that have been rolled out. To date, Street 
View has produced photographs taken in U.S. cities. We were concerned that street level 
photography, as currently deployed in the U.S., may not meet the basic requirements 

of privacy laws here in Canada. I wrote to Google outlining these concerns and we 

have received assurances from Google officials that they will ensure Street View will be 
compliant with Canadian legislation if it is deployed in Canada. 


Identity Management 


The issue of identity integrity and protection stems from the fact that massive amounts 
of data are continually circulating. 


Personal information has become a hot commodity, not only for legitimate 
organizations, but for criminals as well. We have seen an explosion of identity theft in 
recent years — a crime which carries both economic and emotional costs. 


Improving personal information management practices can go a long way to reducing 
the possibility data will make its way into the hands of identity thieves. Our goal is to 
increase awareness of the importance of handling personal information with great care. 
Our public education efforts will be aimed at both organizations and individuals. 


An important focus will be on the online world, where personal information is 
increasingly dispersed across commercial sites, social networks and personal blogs. 
People are finding the personal information they've posted online being used in ways 
they never imagined. In some cases, entire profiles — name, photo and other personal 
details — have been hijacked by impostors. We are developing tools to help people 
manage their online identity. 


National Security 


National security measures introduced in the wake of the attacks of Sept. 11, 2001 have 
transformed the privacy landscape in Canada and around the world. 


Too often, these measures have focused on the collection and sharing of personal 
information with little oversight and scant consideration of privacy and other individual 
rights. A growing list of private-sector organizations — airlines, banks and accounting 
firms, for example — have been deputized to collect personal information for the state. 
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New Stratecic Priorities 


‘The way we address security needs to reflect our society’s fundamental values — including 
the right to privacy. We must constantly ask ourselves why we accept the growing shift 
towards security at the expense of privacy. Is it always justified? Is it irreversible? 


‘These are messages we will continue to press as we work to ensure that national security 
initiatives adequately protect privacy. 


Genetic information 


Advances in genetics are creating an array of new and complex challenges for privacy 
protection. 


Interest in obtaining genetic information is increasing swiftly. Genetic testing for 
employment, criminal matters, research, medical care, access to insurance and to 
determine family relationships all raise significant and deeply sensitive privacy issues. 


There’s a need to increase public awareness about how genetic information can be used. 


We must also explore some of the new challenges for protecting privacy in a world 
where our genes reveal so much about us. 
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KEY ACCOMPLISHMENTS IN 2007 


Proactively Supporting Parliament 


Appeared before parliamentary committees on issues such as identity theft and 
amendments to the Canada Elections Act. 


Worked with the Standing Committee on Access to Information, Privacy and 
Ethics on the statutory review of PIPEDA, responded to Industry Canada’s 
consultation on PIPEDA review. 


Joined provincial and territorial counterparts in passing a resolution calling on 
the federal government to suspend its new no-fly list program until it can be 
overhauled to ensure strong privacy protections for Canadians. 


Serving Canadians 


Responded to more than 7,500 PIPEDA-related inquiries. 
Investigated hundreds of privacy complaints in the public and private sectors. 


Created a blog to help build links and stimulate discussion on privacy issues of 
interest to Canadians. 


Began work on a social marketing campaign aimed at encouraging awareness 
and prompting action on children’s privacy online. 


Appeared in numerous court cases in order to help develop privacy-conscious 
jurisprudence in Canada. 
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Supporting Business 


e Launched an e-learning tool to help retailers ensure their privacy practices and 
policies meet their legal obligations and provide customers with the privacy 
protections guaranteed under PIPEDA. 


e Published guidelines to help organizations take the right steps after a privacy 
breach, including notifying people at risk of harm after their information has 
been stolen, lost or mistakenly disclosed. 


e Initiated a regional outreach program to extend and tailor compliance education 
to small and medium-sized businesses. 


Global Initiatives 


e Hosted the largest-ever International Conference of Data Protection and 
Privacy Commissioners, honouring a 2002 commitment. 


e Chaired an OECD group working to enhance cooperation between data 
protection authorities and other privacy rights enforcement agencies around the 
world. OECD adopted a recommendation on cross-border cooperation which 
was based on the work of the volunteer group. 


e Contributed to an APEC data privacy group’s efforts to implement a new 
privacy framework for APEC member countries. 


e Worked with the Standards Council of Canada on the development of 
international privacy standards. 


e Joined the International Standards Organization (ISO) and became a member 
of an important ISO Working Group tasked with developing and maintaining 
standards and guidelines addressing security aspects of identity management, 


biometrics and the protection of personal data. 


e Participated in the International Working Group on Data Protection in 
Telecommunications, which has recently focused on Internet privacy. 


e Played a lead role in the creation of an international association of data 
protection authorities and other enforcement agencies from francophone states. 


e Became a member of the Asia Pacific Privacy Authorities Forum 
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Key ACCOMPLISHMENTS IN 2007 


Other Highlights 


Prepared a submission and appeared before the Commission of Inquiry into the 


Investigation of the Bombing of Air India Flight 182. 


Provided research grants to eight organizations through our contributions 
program — bringing the total funding provided for privacy research projects 
under the program over the last four years to over $1 million. 


Co-hosted an Internet Privacy Symposium with the University of Ottawa’s 
Law and Technology Group to explore new threats to online privacy, emerging 
trends and ways to better protect personal information in the future. 


Hosted a conference for investigators in Winnipeg in February 2007. The 


conference was attended by 56 investigators from our Office and 11 provincial 
and territorial offices. 
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KEY ISSUE: DATA BREACHES 


Gambling with Personal Information 


2007 was a year of data privacy disasters, highlighting the need for companies to 
recognize the value of personal information and take more care in securing it 


Not so long ago, a group of executives was debating the merits of delaying an upgrade of 
their company’s out-of-date computer security system. 


One of them cautioned his colleagues in an e-mail: 


“Tt must be a risk we are willing to take for the sake of saving money and hoping we do not get 
compromised.” 


‘Those words were prescient. 


‘They were written by a vice-president at TJX — a name which has become synonymous 
with data breach. The e-mail was released during legal proceedings against TJX. 


In fact, hackers had already broken into the international discount retailer’s computer 
system and were busy pilfering the personal information of people who had shopped at 
Winners, HomeSense and other TJX-owned stores. The company’s obsolete encryption 
technology was not up to the job of protecting this sensitive data. 

TJX was one of many companies gambling with Canadians’ personal information. 

Too often, large corporations underestimate both the value of personal information and 
the risk that thieves will target it. As a result, we see deficient safeguards, lackadaisical 
privacy and security policies and procedures — and, of course, data spills. 


‘The size of the worst of the data breaches we saw in 2007 was staggering. 


Some 94 million debit and credit card numbers belonging to people in several countries 
were affected by the TJX intrusion — the largest personal information breach on record. 
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In a case in the United Kingdom, an official at Her Majesty’s Revenue and Customs 
department ignored security procedures and put two discs containing the personal 
details of 25 million child benefit recipients into an envelope, which was then mailed 
through an internal post system. The discs failed to reach the addressee at another 
government department. 


Here in Canada, a hard drive belonging to a CIBC subsidiary vanished — along with the 


personal information of close to half a million clients. 


Of course, not all of the data compromised in these 
kinds of breaches winds up in the hands of criminals. NOTE: Information on data 


breaches voluntarily reported to 
our Office in 2007 is provided on 
page 39. 


However, it is clear crooks have recognized that personal 
data is a goldmine. Identity theft is rampant — and 
lucrative. 


Businesses recognize the value of personal information to themselves — for targeted 
marketing campaigns, for example. Unfortunately, this perception doesn't always 
translate into security measures up to the job of protecting the information from 
criminals. 


Just before the TJX breach became public, for example, Visa USA revealed that a 

little over a third of the very biggest retailers in that country were complying with the 
industry security standard. The figure for other large merchants was even worse — just 15 
per cent. 


We understand the picture in both the U.S. and Canada has been improving in the wake 
of TJX. Visa Canada has told us that virtually all major retailers were well on their way 


to compliance with the payment card industry data security standard. 


One word — TJX - is no doubt going a long way when security experts ask senior 
executives for money to pay for upgrades. 


All organizations must use strong security to protect personal information. It is not good 
enough to offer the excuse that, “We were moving as slowly as other companies.” 


Good security is expensive, but it is significantly less expensive than mopping up after a 
major data spill. Security experts have calculated that recovering from a significant data 


breach costs several times more than installing adequate safeguards in the first place. 


Good privacy practices also go a long way to protecting personal information. 
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PIPEDA sets out 10 fair information principles that businesses must follow. These 
principles — sometimes called the “golden rules” of privacy — include such basics as 
seeking consent for the use of personal information; limiting the use, disclosure and 
retention of personal information; and using appropriate security safeguards. 


‘The starting point for implementing these fair information principles is to critically 
examine the personal information being collected. Organizations should only collect 
personal information which is absolutely essential. After all, if you don’t have this kind 
of information in the first place, it can’t be lost or stolen. 


A second critical step is to recognize the value of personal information which is 
collected and protect it properly. 


By following this bottom-line advice, an organization should wind up with a relatively 
small and well-protected target. 


The OPC has developed more detailed online training on how retailers can put fair 
information principles into practice. The e-learning course is available on our website. 


Employee training is also critical to preventing data breaches. In many of the breach 
reports we receive from companies, the cause of the compromise is an employee’s failure 
to follow company procedures. 


For example, laptop theft is a common type of breach. We see employees leaving the 
office with laptops containing customers’ sensitive personal information — contrary to 
company security policies. 


Policies and procedures are only as good as the training that reinforces them. 


Unfortunately, a survey of Canadian businesses conducted for our Office in 2007 found 
that only one third of them report having trained staff about their responsibilities under 
Canada’s privacy laws. Larger businesses were the most likely to have provided training, 
with 63 per cent confirming they had done so. 


Companies that have not trained employees who deal with personal information are 
exposing themselves to a significantly increased risk of a data breach. We hope to see 


more encouraging numbers the next time we conduct a survey on compliance with 
PIPEDA. 


During 2007, we developed breach guidelines in consultation with industry and civil 


society groups. These guidelines outline key steps organizations should take after a 
breach, such as containing the breach, evaluating the associated risks, notifying the 
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people affected and preventing future breaches. The guidelines have also been adopted 
as a model in New Zealand. The Australian Privacy Commissioner is also proposing to 


adopt the guidelines. 


We have been clear that voluntary guidelines do not take away from the need for breach 
notification legislation. 


In fact, we have been urging the federal government to amend PIPEDA to add a 
notification requirement. 


We believe mandatory notification will help protect personal information in two very 
important ways. First, it will provide an incentive for organizations to take privacy and 
security more seriously; and, second, it will give people the information they need to 
take measures to protect themselves against identity theft or other forms of fraud. 


It is clear that people want this kind of information. 


More than three-quarters of Canadians (77 per cent) believe government agencies 
and affected individuals should be notified if sensitive personal information is 
compromised as a result of a breach, according to a 2007 poll commissioned for our 
Office. Meanwhile, 66 per cent wanted to be notified if non-sensitive information was 
compromised. 


One of PIPEDA’s tenets is that individuals should have control over their personal 
information. Breach notification offers people a choice. Individuals can decide for 
themselves how to respond to a breach. One person could decide that it would be a 
good idea to check her credit report more often. Another person may feel no action is 
warranted. 


What’s important is that the individual retains control. 


Our Office believes breach notification is an important part of a comprehensive 
approach to reducing data breaches. 


The TJX debacle, along with headlines about missing computer discs and hard drives 
as well as other lost data are a wake-up call for all organizations that collect personal 
information. These incidents starkly illustrate the need for companies to make both 
privacy and security a top priority. 


When Canadians entrust their personal information to an organization, they expect — 
and the law requires — that this information will be well protected. 
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| ADATA BREACH INVESTIGATION : 


THE TJX CASE: HOW HACKERS GAINED ACCESS TO 94 MILLION CREDIT AND DEBIT CARDS 


‘The story of what has been called the “largest-ever online burglary” began one summer 
day in 2005. 


It’s believed that thieves armed with an antenna and a laptop computer and some 
specialized software settled in outside a Marshall’s in Miami and broke into the store’s 
poorly protected wireless local area networks. 


Once inside, they tapped their way into computer servers that process and store 
customer information from transactions for hundreds of stores owned by discount retail 
giant TJX, including Winners and HomeSense stores in Canada. 


For the next year and a half, the thieves plundered the TJX computer system. 


‘They ultimately gained access to at least 94 million credit and debit cards as well as the 
names, addresses and driver’s licence numbers of people who had returned merchandise 


at TJX stores. 


The crime wasnt particularly sophisticated. Detailed instructions on cracking the 

. 5) . . . 
encryption protocol used to guard TJX’s wireless networks were readily available on the 
Internet. 


It had been well established for some time that this encryption protocol — Wired 
Equivalent Privacy, or WEP — did not provide adequate network protection because it 
could be easily bypassed by someone with a bit of computer savvy. 

TJX was aware of the concerns about its encryption protocol and was in the process 
of converting to a stronger technology at the time of the breach. In our view, the 
conversion was not done within a reasonable period of time. 

The OPC’s investigation, conducted jointly with Alberta Information and Privacy 
Commissioner Frank Work, concluded TJX did not comply with either federal or 
Alberta privacy laws. 

KEY FAILINGS 


The investigation highlighted a few critical failings: 


1. TJX collected too much information and kept it for far too long. 
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The company should not have collected driver’s licence and other identification numbers 
when merchandise was returned without a receipt. A driver’s licence is proof someone 

is authorized to drive a car — not an identifier for analysing shopping-return habits. As 
well, a driver’s license number is invaluable to identity thieves. 


In response to our concerns, TJX proposed an innovative new process to deal with 
fraudulent returns. Information such as a driver’s licence number will still be requested 
and keyed into the point-of-sale system, however, it will instantly be converted into a 
unique identifying number. This will allow tracking of unreceipted merchandise returns 
without keeping original identification numbers. 


Prior to the breach, identification information collected from people returning goods 
was kept indefinitely. 


Credit card information was also retained for a long time — some of the stolen 
information involved transactions dating back several years. 


2. TJX failed to update its security systems in a timely way. 

TJX’s process for converting to an up-to-date encryption protocol took two years to 
complete, during which time the breaches occurred. As a result, the company did not 
adhere to the requirements of the payment card industry’s data security standard. 

3. TJX did not adequately monitor its system for signs of an intrusion. 

The thieves were able to continue stealing data for a year and a half before TJX learned 


that suspicious software had been detected on a portion of its computer system. With 
proper monitoring, TJX should have detected the incident sooner. 


LOOKING AHEAD 


TJX has complied with all of the OPC’s recommendations on improving security, 
monitoring and other personal information management issues. 


A year after it was discovered, the intrusion continued to have an impact. 
Some legal proceedings against the company were ongoing. Investigations by the U.S. 
Federal Trade Commission, as well as an investigation by the Massachusetts Attorney 


General on behalf of a group of more than 30 state Attorneys General were continuing. 


It’s unclear how much the breach will wind up costing the company — but the total bill 
will certainly be in the hundreds of millions of dollars. 
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By the end of 2007, TJX had named a chief privacy officer and was advertising for a 
privacy director to develop and implement a comprehensive information privacy and 
security program. 


How our Office Helps Organizations Prevent Breaches 


e We launched an online learning tool offering step-by- 
step guidance for retailers on how to protect customer 
information and meet PIPEDA obligations. 


e We have published various online and printed materials 
on how businesses can safeguard personal information, 
including the booklet, Your Privacy Responsibilities: A 
Guide for Businesses and Organizations. 


e We developed voluntary data breach guidelines in 
consultation with industry and consumer groups. 


e We advise and assist organizations with their breach 
response actions, including advice on notification of 
affected individuals. 


e We continue to press the federal government to make 
breach notification mandatory under P/PEDA, a move 
we believe would encourage businesses to improve 
security measures. 


e We conduct audits of the personal information 
management practices of organizations covered by 
PIPEDA if we have reasonable grounds to believe the 
organization is contravening the legislation. 


e Our investigations into privacy complaints help 
identify steps that businesses can take to better protect 
personal information. 
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IMPROVING P/PEDA: 
A REVIEW OF OUR PRIVATE-SECTOR PRIVACY LAW 


A Parliamentary committee completed a mandatory review of PIPEDA in 2007 
— an important step towards strengthening privacy protections for Canadians 


PIPEDA, along with its public-sector sister legislation, the Privacy Act, and provincial 
legislation provide the foundation for privacy protection in Canada. 


‘The privacy landscape is constantly changing — and our laws need to keep up. 


Consider how much the world has changed since a decade ago, when we began talking 
about what a private-sector privacy law in Canada should look like. 


Back then, the Information Highway was a catchphrase; now it is a reality. The trickle 
of personal information crossing borders has become a torrent. Meanwhile, emerging 
technologies such as location tracking devices are raising new risks for privacy. And the 
fallout from 9-11 means governments are asking businesses for more information about 
our day-to-day lives. 


It is critically important that PIPEDA remains capable of addressing all of these new 
challenges. The desperately out-of-date Privacy Act — left unchanged for a quarter- 
century — is evidence of the dangers of failing to modernize privacy legislation. 


Fortunately, PLPEDA’s architects recognized the importance of regular updating. The 
legislation requires Parliament to review the part of the Act dealing with data protection 
every five years. 


The House of Commons Standing Committee on Access to Information, Privacy and 


Ethics took on the task of conducting the first five-year review, beginning their work in 
the summer of 2006. 
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Committee members wrapped up public hearings on a wide range of issues in February 
2007. They heard from 67 witnesses and considered 34 submissions from individual 
Canadians, private sector associations, privacy advocates and the Privacy Commissioner. 


Overall, we feel the legislation has been well-received, that it is working reasonably 
well, and that we have most of the tools and powers we need to enforce the Act. The 
legislation offers Canadians strong privacy protections in the commercial sphere. 


In our submissions to the committee, we noted the legislation has only been fully in 
force since 2004. While experience to date has been instructive, more time is needed 
before any major changes are made. The full impact of complex legislation takes time to 


unfold. 


That said, some adjustments would be welcome to ensure privacy protections evolve with 
new trends and technologies. 


In May 2007, the committee presented its final report, which included 25 
recommendations for the government’s consideration or further discussion. 


Suggested amendments touched on a broad range of issues, including: business 
contact information; work product information such as physicians’ prescribing 
patterns; employee-employer relationships; investigative bodies; witness statements; 
law enforcement and national security; individual or family exceptions; disclosure of 
personal information before transfer of businesses; added protection for minors; and 
mandatory data breach notification. 


We deeply appreciate the effort of the Parliamentarians, researchers, organizations and 
citizens who contributed their experiences and expertise to the review process. 


The Government of Canada tabled its response in October. In our view, a very 
significant element of the response was the acknowledgement that an increasingly global 
response is required to meet privacy threats. The data-processing industry has become 
increasingly international, and so too have data security risks. 


Inter-governmental cooperation, information sharing between jurisdictions and 
attention to trends emerging in other parts of the world have all become vital strategic 
considerations as we work to protect the privacy of Canadians. 


In October, Industry Canada issued a consultation notice seeking public input on how 


best to implement certain provisions of the Government response. Views on data breach 
notification provisions, and the concepts of “work product” and “lawful authority,” were 
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given particular emphasis. As well, Industry Canada sought views on witness statements, 
minors’ consent and investigative bodies. 


As part of this round of consultations, the Privacy Commissioner asked the Minister of 
Industry to closely consider five issues which will significantly impact our work in the 
years to come: 


e We continued to promote a ‘contextual’ approach to work product information. 


e We supported a requirement for breach notification, and stressed the need for clear 
triggers and thresholds in any new PIPEDA provisions. 


e Weasked that the possibility of PLPEDA amendments governing access to 
documents covered by solicitor-client privilege be left open, pending a decision 
from the Supreme Court of Canada in Privacy Commissioner of Canada v. Blood 
Tribe Department of Health. 


e We urged that any new provisions on privacy in the employer-employee context 
take Alberta and Quebec legislation into consideration in order to better recognize 
that the unequal bargaining power in employment relationships means employees 
may not feel in a position to withhold consent for the collection of their personal 
information. Our Office sees merit in Alberta’s approach of a reasonable purposes- 
based employee code, combined with the notion in the Quebec Civil Code, which 
obligates employers to respect the dignity of workers. 


e We asked for greater flexibility to refuse and/or discontinue complaints if their 
investigation would serve no useful purpose or are not in the public interest, thereby 
allowing us to focus investigative resources on issues of broader systemic interest. 


The deadline for comments to Industry Canada was mid-January 2008. The department 
received 67 submissions and was reviewing those in early 2008. 


We look forward to the next stage of the legislation’s review and the important 


dialogue it serves to generate between privacy advocates, regulators, industry and 
Parliamentarians. 
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COMPLAINT INVESTIGATIONS AND INQUIRIES 


As Canadians become more knowledgeable about privacy issues, organizations are 

being challenged to fulfill their responsibilities with respect to personal information. In 

particular, consumers are increasingly aware of the serious ramifications of identity theft 
and, as a result, are more insistent that companies meet their obligations when collecting 
personal information. 


People do not want sensitive information such as driver’s licence numbers collected and 
retained without a legitimate reason, nor do they want their credit card numbers and 
expiry dates printed on receipts. 


Many companies do take their privacy responsibilities seriously. But it is also clear — 
both from the complaints we receive and from the data breaches voluntarily reported to 
our Office — that many organizations could do more. 


Businesses that handle personal information need to update their privacy policies and 
practices regularly. They must keep their data security up-to-date. And, they must also 
ensure that employees are kept informed of changes and receive regular training. 


Inquiries 

Our Inquiries Unit responds to questions from individual Canadians, government 
institutions, private sector organizations and the legal community. Inquiries officers 
provide information on a broad range of issues under both PIPEDA and the Privacy Act. 
We received 7,636 PIPEDA-related inquiries in 2007, a substantial increase from the 


6,050 received a year earlier. We have noticed a marked increase in interest concerning 
identity theft and social networking sites such as Facebook. 


Complaints 


We received 350 new PIPEDA complaints during 2007. We received 424 complaints in 
2006; 400 in 2005; and 723 in 2004. 
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‘The year-over-year decrease in complaints is, in part, the result of a streamlined 
complaint-acceptance process introduced in 2007. Under this process, when an 
individual brings a complaint which is factually similar to complaints already under 
investigation, we inform the individual that the issue is already under investigation and 
will be addressed by the Commissioner in her findings. This approach is also used with 
complaints for which a finding has already been issued on a similar case. 


In such cases, we offer complainants the option of referring to similar findings as a way 
to resolve the particular issues they may have with an 


sr nama NOTE: Detailed information 


By way of example, we currently have underway five ee implants aswell as 


investigations concerning drug testing for employment, findings and other dispositions 
while an additional 27 people agreed not to file official are included in Appendix 1 of 
complaints about the same issue. this report. 


In some instances, although an individual’s situation may be similar to that of another 
complaint, the facts may vary enough to warrant a full investigation. 


Another possible reason for the decline in complaints is that organizations may be 
becoming more knowledgeable about their privacy obligations. Moreover, many now have 
internal complaint-resolution processes in place in order to resolve privacy issues with their 
customers. Our Inquiries Unit also advises individuals to attempt to resolve their disputes 
with organizations before they file a formal complaint with our Office. 


Complaints by Sector 


As has been the case since 2004, when PIPEDA was fully implemented, the financial 
institutions sector was the sector most often targeted in our 2007 complaints. We 
received 105 complaints involving financial institutions in 2007. This represented almost 
a third of total PLPEDA complaints, which is similar to the proportion of complaints 
involving this sector over the last few years. 


As in past years, the other major sectors for complaints were telecommunications, 
insurance, sales and transportation. We have, however, seen a decrease in complaints 
involving companies in these industries over the last few years. 


We have seen a steady increase in complaints about professionals and the 


accommodation sector. However, the number of complaints against these sectors 
remains small in comparison to others. 
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With respect to complaints involving the insurance industry, we are seeing more issues 
involving the covert collection of personal information by private investigation firms. 


PIPEDA includes provisions for designating a private investigation company as a 
“private investigative body” which carries specific responsibilities under the legislation. 


We understand there may be a need for covert collection of personal information where 
other less privacy invasive efforts have failed. However, a key concern about this type 

of investigation is the risk that innocent third parties may be captured on covert video 
surveillance tapes. Few of us would like to be videotaped in a bathrobe on our front step 
simply because we happen to live next to someone under suspicion of insurance fraud. 


We are working with both insurance and private investigation organizations to find a 
balance between their need to conduct their business and individuals’ right to privacy. 
Insurance companies and their contractors should conduct covert surveillance only as a 
last resort. Businesses should ensure that the decision to conduct covert surveillance is 
made at a senior level. 


Part of the solution may be for insurance companies to establish detailed contracts 
with investigative firms to ensure that the parameters of surveillance are clearly spelled 
out. As well, investigative firms need to develop specific polices regarding surveillance, 
including the videotaping of third parties. 


Complaint Trends 


Our Office closed 420 complaints in 2007. Of these, the vast majority (39 per cent) 
concerned use and disclosure issues, a trend which has continued from previous years. 
Also consistent with previous years, other common types of complaints were collection 
(19 per cent) and access (16 per cent). 


Closed 2007 Complaints By Finding 
Almost a third (30 per cent) of 


complaints closed in 2007 were ARG CSTE 


settled during the course of an Settled 30 
investigation. These are complaints 


Discontinued 21 
for which the Office has negotiated = 
an outcome which is satisfactory to Not well-founded He 
all parties and no finding is issued. Well-founded Resolved 15 
In 2004, we defined the “settled” Resolved 10 
category in order to track this Early Resolution 3 
ts No jurisdiction =) 

Well-founded 2 
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In 2004, 40 per cent of our cases were settled. Since then, however, this percentage has 
steadily declined. The trend may be a reflection of the fact we are seeing more complex 
cases where an extensive investigation is required. 


A significant number of closed cases were discontinued (21 per cent) by the complainant 
or our Office. ‘This represents an increase over previous years. As in the past, some 
complainants decide for personal reasons to abandon their complaints. Others do not 
proceed because they have resolved the issue with the organization before the active 
investigation has begun. Still others drop their complaints because of lengthy treatment 
times. Sometimes our Office must discontinue complaints because complainants have 
not provided us with additional details which we have requested and are necessary to 
complete an investigation. 


Following the completion of investigations, 15 per cent of all complaints were found to 
be not well-founded and that the organization had complied with PIPEDA. Another 
15 per cent of complaints were well-founded and resolved. In other words, there was 

a violation of PIPEDA, but the respondent organization agreed to comply with our 
recommendations. 


The determination of whether a fully investigated complaint is well-founded or is 
well-founded and resolved depends on the level of cooperation we receive from the 
respondent organization. 


A finding that a complaint is well-founded is reached when the Commissioner is of the 
view there has likely been a contravention of PIPEDA. She makes recommendations in 
a preliminary report with respect to corrective actions the respondent should take. The 
respondent has 30 days to reply to the preliminary report. 


Since this new preliminary report process was established in 2006, it has become an 
effective means of ensuring that organizations remain accountable. 


If the respondent complies with the recommendations, a well-founded and resolved 
finding is usually reached. In cases where the respondent does not fully comply, the 
complaint is deemed to be well-founded. 


We included preliminary reports in 38 closed complaints in 2007. Of these, 34 
organizations complied with the Commissioner’s recommendations. 


In 2007, only four organizations chose not to implement our recommendations at the 


conclusion of an investigation. The Commissioner has consistently sought to have her 
recommendations upheld by the Federal Court in such cases. 
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As we prepared to publish this annual report, all four organizations that initially 
declined to adopt our recommendations had finally agreed to comply, either before or 
after we referred the matters to litigation. 


Treatment Times 
The average treatment time (calculated from the date the complaint is received to the 


date the report of finding is mailed) for PIPEDA complaints closed in 2007 was 15.7 
months — approximately the same as in 2006. 


On a more positive note, there were only 44 files in abeyance — unassigned because no 
investigator is available — at the end of 2007. That’s substantially lower than the 76 files 
in abeyance the previous year. 


We are committed to reducing treatment times and eliminating the backlog of cases — 
without compromising quality. Our Office is actively pursuing innovative steps to that end. 


Changes implemented in recent years, including the hiring and training of new staff, 
have helped revitalize our investigations unit. We plan to further improve service 
delivery by: 

e Continuing to hire more staff; 

¢ Increased automation and the use of technology in processing files; and 

e Streamlining our investigation processes. 
All of this work is essential to sustaining Canadians’ renewed trust in our Office and 
in our ability to protect their privacy rights. Fair, prompt and effective treatment of 


complaints also provides a key opportunity for educating both the private sector and 
individual Canadians. 


Commissioner-Initiated Complaints 


The Commissioner uses her powers to launch complaints on a wide range of privacy 
issues. Following are summaries of two significant Commissioner-initiated complaints 


closed in 2007: 
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SWIFT Case: Transborder data flows raise new privacy risks 


The Privacy Commissioner launched an investigation in August 2006 following 
newspaper reports that the Society for Worldwide Interbank Financial 
Telecommunication (SWIFT) had disclosed tens of thousands of records containing 
personal information to the U.S. Department of the Treasury. 


The disclosed materials included personal information originating from, or transferred 
to Canadian financial institutions. This likely included such information as names, 
addresses, account numbers and amounts of transfers. 


In Canada, SWIFT collects personal information from, and discloses it to, Canadian 
banks for cross-border payments, securities clearing and settlement, and treasury and 
trade services. Its presence in Canada is significant. The vast majority of international 
transfers involving personal information flowing to and from Canadian financial 
institutions use SWIF'T’s network. 


Following an investigation, the Commissioner concluded in April 2007 that SWIFT 
was subject to PIPEDA, but had not contravened it. 


The Commissioner noted that the legislation allows organizations such as SWIFT to 
abide by the legitimate laws of other countries in which it operates. She also noted 
that PIPEDAs exception to knowledge or consent applies to an organization disclosing 
personal information when a lawful subpoena is issued. 


In this case, the U.S. Department of the Treasury began issuing subpoenas to SWIFT 
for data held in its U.S.-based operating centre following the terrorist attacks of Sept. 
11, 2001. 


In her findings, the Commissioner noted that if U.S. authorities need to obtain 
information about financial transactions with a Canadian component, they should 

be encouraged to use existing information mechanisms that have some degree of 
transparency and built-in privacy protections, such as Canadian anti-money laundering 
and anti-terrorism financing mechanisms. 


Telecommunications Case: Highlighting the importance of authentication 


Assistant Privacy Commissioner Raymond D’Aoust initiated complaints against three 
Canadian telecommunications companies following the publication of a November 
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2005 article in Maclean’ describing how the magazine had obtained the Privacy 
Commissioner’s telephone records. 


The records were purchased from a U.S. data broker, Locatecell.com, which had 


obtained them from Bell, TELUS Mobility and Fido. 


‘The investigation revealed that Locatecell.com had used “social engineering” to persuade 
phone company customer service representatives to divulge confidential information, 
either in the specific instances alleged and/or subsequent test cases. Social engineering 
involves manipulating people into divulging personal information, for example, by 
pretexting — pretending to be someone authorized to obtain the information. 


The Assistant Commissioner concluded that the companies’ authentication procedures 


and staff training were not sufficient to adequately protect customer information or meet 
PIPEDA requirements. 


He was also concerned that the companies had not done enough to alert employees 
about the tactics used by data brokers — even though concerns had already been raised by 
incidents in the United States. 


Although the Assistant Commissioner was pleased that all three companies revised 

their customer authentication procedures shortly after the disclosures came to light, 

he recommended further changes to staff training, procedures on authentication and 
disclosure of personal information. 


The companies implemented all of these measures except one, for which they proposed 
other actions which the Assistant Commissioner found acceptable. As a result, he found 
the complaints well-founded and resolved. 


The Assistant Commissioner noted that organizations must adapt their personal 
information management policies and practices as threats to personal information 
continue to emerge and evolve. 


Initially, the Assistant Commissioner also opened a complaint against Locatecell.com., 
however, preliminary results of our inquiries revealed we lacked jurisdiction to continue 
the investigation. 


Following these incidents and legal actions against data brokers in the United States, 


broker activities have either stopped or been drastically curtailed. Many broker websites 
are unavailable, and the Locatecell.com site has been inoperative for some time. 
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CASES OF INTEREST 


The following represent a sample of cases we worked on in 2007 which have a systemic 
significance for privacy issues in Canada. 


Court decision prompts cross-border investigation 


A Federal Court decision in February 2007 set aside the Privacy Commissioner’s 
decision that she lacked jurisdiction under PIPEDA to investigate a complaint against a 
U.S.-based data broker, Accusearch Inc., operating as Abika.com. 


As a result of this decision, our Office is conducting an investigation of a complaint filed 
by an individual against Accusearch. As part of our investigation, we have contacted the 

U.S. Federal Trade Commission, and are actively discussing how we can work jointly on 

issues pertaining to Accusearch. 


Credit card number printed on airline ticket 


When a travel agency customer purchased an airline ticket, he was upset to discover that 
his credit card information had been transferred to a travel wholesaler and that the full 
card number and expiry date were printed on his ticket. 


The Commissioner recommended that the travel agent better inform customers of the 
fact their personal information would be transferred to wholesalers. 


As well, the Commissioner recommended that the agency confirm the wholesaler’s 
personal information handling practices, noting that — although there was a related 
contract between the two parties — the wholesaler was reluctant to reveal its practices. 


The agency later informed our Office that it would no longer conduct business with the 
wholesaler. 


Until the issuing of paper tickets ceased altogether (in December 2007), the 
Commissioner recommended that the agency explain to customers that credit card 
information would appear on paper tickets. Additionally, it must offer them the option 
of an e-ticket, which does not contain this information. 
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Insurance officer discloses information without proper consent 


An individual complained that a medical insurance benefits administrator 
inappropriately disclosed sensitive personal information to his employer, despite the fact 
he had signed a limited consent form for information disclosure. 


When the individual applied for long-term disability benefits, he had negotiated a 
restricted consent agreement with the insurance company adjudicator, with the express 
purpose of restricting the insurer’s right to transfer medical information to his employer. 


Months later, an insurance rehabilitation officer retained by his employer thought she 
had the complainant’s verbal consent to tell his employer that he was ready to return to 
work. 


In doing so, she e-mailed to his employer excerpts of a medical specialist’s report — even 
though the complainant had reminded her of the limited consent instructions. 


‘The Privacy Commissioner concluded the disclosure was inappropriate and 
written consent ought to have been obtained. The Commissioner recommended 
that the company update its policies and training. The company followed these 
recommendations. 


Telecommunications company fails to obtain consent to record calls 


An individual complained that a telecommunications company was not obtaining proper 
consent before recording its outgoing calls. 


The company had called the complainant’s mother, but had not informed her that the 
call was being recorded. The company’s policy required employees to notify individuals 
of the recording of incoming calls, but not outgoing calls. 


According to the company, a statement in its written privacy policy was a sufficient 
means for obtaining consent for the recording of outgoing calls; however, the Privacy 
Commissioner disagreed. 

She recommended the company inform customers at the beginning of each outgoing 
marketing call that the conversation would be recorded or otherwise monitored. 


Customers should also be informed of the reason for doing so. 


The telecommunications company agreed to implement the recommendations. 
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TV station takes steps to secretly record employee calls 


A union representing employees of a television station in a small community alleged 
that a manager had installed telephone-call recording equipment at a customer service 
representative's work station and had taped her telephone conversations without her 
knowledge and consent. 


The investigation confirmed the allegation. We retrieved a recorded conversation 
between the employee and her husband from a file in the complainant’s computer. ‘The 
complainant told us she had not been aware that the call was being recorded. 


When questioned, the employer claimed the equipment was not yet working and that it 
had been installed on a test basis, with the intent of recording conversations in case of a 
billing dispute and also to deter abusive customers. 


The Assistant Commissioner recommended that, since the station intended to install 
equipment at all customer service representatives’ work stations, it must inform 
employees of its plans and their purpose beforehand. It was also required to inform 
customers that their calls may be recorded and why this was being done. 


The complaint was considered well-founded and resolved. The station ultimately decided 
not to record calls. 


Contest rules adequately warned about sharing of e-mail addresses 


A subscriber to a company’s e-newsletter entered its contest to win a vacation for four 
people. He provided e-mail addresses of other individuals so that he could receive 
additional contest entries. 


However, he was dismayed when he discovered that the e-mails the company sent to 
those other individuals were designed to appear as though they came from him. In 
particular, he was upset that his ex-wife had received an email in which he purportedly 
suggested the two of them travel together if he won the contest. 


He complained his name had been used in the e-mails without his consent. 
The Assistant Privacy Commissioner concluded the complaint was not well-founded. 


The contest rules and wording were clear that e-mail messages to referrals would be 
personalized as though the contestant had sent them. Given that the prize was a trip for 
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four, she thought it reasonable to expect the message could include a suggestion that the 
subscriber and e-mail recipient travel together. 


Incident Investigations 


Our Office also conducts investigations of incidents that relate to possible 
contraventions of PIPEDA. Reports of incidents are received through self-reporting 
by organizations; media reports on possible breaches; and information received from 
individuals who would like an issue to be addressed, but are not necessarily directly 


affected. 


Examples of incidents include issues such at credit card receipts found in dumpsters or 
reports of information breaches on websites. 


When an incident comes to our attention, we work with the responsible organization 
to correct any deficiencies and resolve outstanding matters such as notifying affected 
customers; retrieving information; and ensuring appropriate safeguards are implemented. 


In 2007, we conducted 12 investigations into incidents brought to our attention from a 
source other than the organization directly involved in the incident. 


Self-reported Data Breaches 


Despite the fact that privacy legislation has been in place for a number of years, not all 
organizations have clear policies and procedures regarding data breaches. That said, 

we believe there is a heightened awareness of the need to alert our Office of privacy 
breaches and also to notify affected customers — in part stemming from the development 
and publication of our breach guidelines. 


Organizations voluntarily reported 34 breaches to us in 2007, up from 20 reports 
the previous year. The self-reported data breaches in 2007 compromised the personal 
information of some 50,000 people. 


Although we began to see reports of breaches from different sectors, including research 
groups and advertising companies, the bulk of these reports continued to flow from the 
banking, telecommunications and retail industries. 


Of particular note is the fact that half of the breaches reported to us related to 
electronically stored data — often customer information stored on laptop computers 
that had been stolen. As well, we found that almost nine in 10 people aftected by a 
self-reported breach were put at risk because their personal information was held in an 
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electronic format that was either not secured or lacked adequate protection mechanisms . 
such as firewalls and encryption. 


We were pleased to note that organizations voluntarily reporting to us did so in a 
timely way — often within a day or two of the incident. Prompt notification helps us 
in preparing for media inquiries or complaints that follow notification of affected 
individuals. Self-reporting also allows us to gather statistics and educate organizations 
and the public on the causes of data breaches as well as recommended preventive 
measures. 


Brief descriptions of some of the breaches reported to our Office in 2007: 


e A laptop being used by the employee of a firm under contract to a financial 
institution was stolen from the employee’s home. ‘The laptop contained the 
personal information of several hundred employees, but was not considered 
sensitive. Both the financial institution and the firm under contract had 
appropriate controls in place to protect personal information, but the 
employee had not followed them. As a result of this incident, the institution 
implemented additional controls such as encryption software. 


e A laptop containing customer records was stolen from a vehicle belonging to a 
financial services company employee. More than half of these records included 
social insurance and account numbers. ‘The company notified individuals and 
placed alerts on the accounts of affected customers. 


e ‘The laptop of an employee of an agency promoting a casino event was stolen 
from a car. The laptop contained a password-protected database of information 
on some event participants, but the data was not encrypted. ‘The personal 
information included participants’ names and ages, contact information, driver’s 
licence numbers and, in one case, passport and health card numbers. Following 
the incident, the agency notified affected individuals and offered credit 
monitoring. It also introduced several security measures, such as encryption 
software on laptops and also reminded employees of security policies and 
procedures. The employee responsible for the breach was relieved of his duties. 


We hope the growing awareness about the need to alert our Office and affected 
individuals about privacy breaches will soon translate into more effective security 
measures. We continue to urge individuals and organizations to take basic data security 
precautions such as: 


e Limit the amount of personal information collected, used and carried on 
electronic devices; 
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e Never leave a laptop unattended where it could be stolen; 


e Use technologies which enhance security and privacy such as data encryption 
and anonymizing services; 


e Use hard-to-crack passwords; 
e Avoid automatic login features which save user names and passwords; and 


e Ensure that personal information is completely overwritten — not just deleted — 
from a hard drive before discarding or selling a computer. 


By following these steps, organizations can significantly reduce the risk that the personal 
information they hold will be compromised. 
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AUDIT AND REVIEW 


Audits are one of the compliance tools provided under PIPEDA. The Privacy 
Commissioner has the power to audit an organization's personal information practices 
where she has reasonable grounds to believe there is non-compliance with the Act. 


Once an audit is initiated under PIPEDA, the auditor has the delegated authority to 
receive evidence from witnesses; may enter premises at any reasonable time; and may 
examine or obtain copies of records found on the premises. Where necessary, the Privacy 
Commissioner may compel individuals to provide evidence. 


After an audit is complete, we provide the organization with a report on our findings 
and any recommendations the Commissioner considers appropriate. The report may be 
disclosed in the public interest. 


Our Office also conducts audits of federal government institutions subject to the Privacy 
Act. 


The goal of audits — both in the private and public sector — is to promote accountability 
and compliance with applicable legislation, policies and standards, and also to contribute 
to the improvement of privacy systems and practices. 


A framework for initiating audits under PIPEDA 


One of the most frequently asked questions from organizations subject to PIPEDA 
might be: How do you decide whether or not to conduct an audit? 


A decision to audit or not to audit is made on a case by case basis. To conduct an audit, 
the law requires the Commissioner to have reasonable grounds that there is non- 


compliance with the Act. 


In 2007, we developed a framework for initiating audits which provides some insight 
into the audit selection process. 
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How do we decide whether or not to conduct an audit under P/PEDA 


PRINCIPLE 1: Do factors exist, or have events occurred, which indicate a risk of noncompliance 
with The Act and/or the absence of sound privacy management practices? 


This process involves the identification, analysis and validation of potential privacy issues 
associated with an industry, entity or program, and where possible, a preliminary review of 
the area’s major privacy management control functions. Issue analysis is generally conducted 
internally using information collected by the OPC through investigations and/or research, but 
may involve several interventions, including enquiries with management. Factors indicating 
the absence of sound privacy management practices may include, but are not limited to: 
credible media reports, the recommendations of parliamentary committees, contraventions 
revealed through whistleblowing, incident investigations, the results of complaint 
investigations, entity or industry requests for review, the results of empirical studies or 
industry polls, other. 


Issue Analysis 


ghout the process of deciding whether or not to 


PRINCIPLE 2: Does sufficient and credible evidence exist to support a serious possibility that an 
audit would disclose an ongoing contravention of the Act? 


Reasonable grounds testing involves the examination of information gathered during issue 
analysis activities, and the assessment of whether there are sufficient grounds to support the 
Commissioner's use of discretionary authority under section 18(1) of the Act. Internally, the 
OPC establishes a clear basis for audit and ensures that a sound evidentiary threshold is used 
in arriving at such a determination. 
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PRINCIPLE 3: Given the results of issue analysis and reasonable grounds determination, what 
measures would best promote and encourage compliance and the use of sound privacy 
management practices? Is the area under consideration best addressed through an audit and 
is it amenable to audit? 


Our Office recognizes that no single tool or instrument will best ensure compliance in all 
situations. For that reason, the Commissioner considers all means available, including audit, 
to encourage compliance and promote sound privacy management practices. The final 
decision to audit would be subject to numerous considerations not limited to: the nature 

of the case, the significance of systemic risks, the frequency with which the issue has been 
identified, the extent to which remedial action has been taken, the results and findings of 
completed or ongoing privacy investigations and previous Office positions. 


A record setting out the basis upon which the Commissioner's decision to initiate an audit is made. 


Auoit anp Review 


Audits of Equifax and TransUnion 


The Privacy Commissioner concluded concurrent audits of the online identification and 
authentication systems of credit reporting bureaus Equifax Canada and TransUnion. 


Equifax initiated legal proceedings challenging the existence of reasonable grounds 
justifying the Privacy Commissioner’s decision to audit. Notwithstanding the position 
maintained by Equifax throughout the process that the audit was not based on 
reasonable grounds, the audit was concluded. A report was provided to Equifax and no 
further steps were required to be taken by Equifax with regard to this audit. 


TransUnion also took the position that the Commissioner lacked reasonable grounds, 
but chose not to take legal action. As was the case in the audit of Equifax, a report was 
provided to TransUnion and no further steps were required to be taken by TransUnion 
with regard to this audit. 


Self—assessment tool 


Our Office is preparing a tool to assist organizations in assessing their compliance with 
PIPEDA and its fair information principles. This tool will help organizations diagnose 
problems with their privacy systems and practices. 


We are seeking comments on this new self-assessment tool from a number of chief 
privacy officers of large businesses; academics; leaders in management development and 


training; as well as business and professional associations. 


We expect to have a final version available for medium- and large-sized organizations in 


2008. 
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IN THE COURTS 


The Privacy Commissioner may initiate court action where an organization refuses to 
adopt her recommendations in well-founded cases, which has helped establish a high 
level of compliance with recommendations. 


Under section 14 of PIPEDA, a complainant or the Privacy Commissioner may, in 
certain circumstances, apply to the Federal Court for a hearing in respect of any matter 
referred to in the Commissioner’s report. 


Section 15 also allows the Privacy Commissioner, with the consent of the complainant, 
to apply directly to the Federal Court for a hearing in respect of any matter covered 

by section 14. This section also allows the Commissioner to appear before the Federal 
Court on behalf of any complainant who has applied for a hearing under section 14; or, 
with the permission of the Federal Court, to appear as a party to any section 14 hearing 
not initiated by the Commissioner. 


Since we reported on the status of ongoing court cases in our 2006 PIPEDA annual 
report, new applications have been filed and some ongoing litigation has been settled. 


These new developments are discussed below. 


In keeping with the spirit and intent of our mandate, we have respected the privacy of 
individual complainants by not including their names. 


Settled Cases 


In 2007, a number of court applications filed against organizations were settled prior to 


being heard and determined by the Federal Court. 
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X. v. ING Canada Inc. 
Federal Court File No. T-1283-07 


A complainant brought an application for judicial review under section 18.1 of the 
Federal Courts Act. The OPC initiated a mediation process, and following a negotiated 
settlement, the application was discontinued by the complainant. 


X. v. Brampton Flying Club 
Federal Court File No. T-192-05 


A complainant filed an application under section 14 regarding allegations that the 
Brampton Flying Club failed to provide access to his personal information within 30 
days of his written request and tried to charge him an unreasonable amount to answer 
his request. This case was settled by the parties in January 2007. 


X. v. Laidlaw Transit Ltd. 
Federal Court File No. T-684-07 


An individual filed a section 14 application challenging a form of workplace surveillance 
that Laidlaw Transit Ltd. had undertaken. The OPC helped mediate the dispute. The 


individual discontinued the application and the parties reached a settlement. 


X. v. The Bank of Nova Scotia 
Federal Court File No. T-2126-05 


This case concerned a complaint that one or more employees of the Bank of Nova Scotia 
obtained personal information without consent and shared the information with a third 
party. The application filed by the complainant in the Federal Court was discontinued by 
the complainant and settled between the parties. 


Privacy Commissioner of Canada v. Air Canada 


Federal Court File No. T-342-07 


The Privacy Commissioner filed a Federal Court application against Air Canada to have 
its recommendations implemented in a case dealing with the extent of personal health 
information collected by the organization to satisfy itself of an employee’s ability to 
return to work. 


‘The parties settled the dispute. Air Canada implemented the Commissioner’s 
recommendations to our satisfaction. 
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Ongoing Litigation 


Ongoing litigation continued in respect of judicial review applications under section 
18.1 of the Federal Courts Act and complainant-initiated court applications filed under 
section 14 of PIPEDA in which the OPC was involved as an added party or as an 
intervener. 


In one noteworthy case, State Farm Mutual Automobile Insurance Company 
questioned the Privacy Commissioner’s jurisdiction to investigate a refusal to provide 
access to personal information and power to compel the production of documents 
during the course of an investigation. 


In July 2007, State Farm filed an application in the Court of Queen’s Bench of New 


Brunswick for a declaration that: 


e PIPEDA did not apply to the disclosure of personal information sought by an 
individual complainant, 


e PIPEDA was enacted outside the powers allotted to the federal Parliament; 


e ‘The Privacy Commissioner did not have the authority to investigate the 
complaint in question; and 


e ‘The Privacy Commissioner did not have the authority to compel production of 
the information sought. 


‘The Privacy Commissioner filed a preliminary motion to have State Farm’s application 
dismissed or stayed on the ground that the Federal Court was the more appropriate 
forum. 


The motion was granted in January 2008 on the basis that the Federal Court was the 
more appropriate forum to determine the application, which involved questions of 
constitutional validity and the judicial review of the Privacy Commissioner’s authority. 
State Farm’s appeal from this decision will be heard in early 2008. Further developments 
will be reported in our next annual report. 


Other significant court decisions rendered in 2007 are set out below. 
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Judicial review applications under section 18.1 of the Federal Courts Act 
Blood Tribe Department of Health v. ‘The Privacy Commissioner of Canada et al. 
Supreme Court of Canada File No. 31755 


Details of this ongoing matter have been reported in our last three annual reports. 
At issue is solicitor-client privilege and our ability to obtain the information we need 
to conduct our investigations. The final outcome — yet to come — will have profound 
implications for how we conduct our investigations. 


The case began when a woman dismissed from her job with the Blood Tribe 
Department of Health asked for her personnel file and was denied access. 


The woman filed a complaint with our Office. As part of our investigation, we asked for 
a copy of the woman's personnel file. The Blood Tribe Department of Health provided 
some records, but claimed solicitor-client privilege over other documents and refused to 
provide them. 


Our position is that we need these documents in order to independently verify the claim 
that personal information being sought by a complainant is exempt from disclosure on 
the basis that it is information over which a claim of solicitor-client privilege has been 
made. 


We issued an order that the organization produce the records. The Blood Tribe 
Department of Health went to court to challenge the Privacy Commissioner's 
jurisdiction to issue this order — bringing the investigation to a halt. 


The Federal Court dismissed the Blood Tribe Department of Health’s judicial review 


application. 


However, the Federal Court of Appeal set aside the Privacy Commissioner’s order, 
finding that language in PIPEDA is not clear enough to grant the Commissioner 
specific power to order the production of solicitor-client privileged documents. The 
Court proposed that we apply on a case-by-case basis to the Federal Court to examine 
claims of solicitor-client privilege in the context of complaints involving refused access 
to personal information. 


We appealed from that decision to the Supreme Court of Canada, which scheduled a 
hearing for February 21, 2008. 


The Privacy Commissioner has said she plans to revisit the issue with the Minister of 
Industry should amendments to PIPEDA be needed as a result of the Supreme Court 


decision. 


IN THE Courts 


a a Ee a se 
X. v. Accusearch Inc., dba Abika.com et al 


Federal Court File No. T—2228-05 
a ae se ee 


An individual filed a judicial review application seeking 
an order quashing or setting aside the Assistant Privacy Note: This case was also reported 
Commissioner’s decision that she lacked jurisdiction to 
investigate a complaint against Accusearch Inc., a U.S.- 
based organization operating as Abika.com. 


in our 2006 annual report. 


‘The individual sought to review the Assistant Privacy Commissioner’s position that she 
did not have jurisdiction to investigate. In February 2007, the Federal Court allowed 
the application on the grounds that the Assistant Commissioner did have jurisdiction to 
investigate the transborder flow of personal information in this case. 


This was an important decision for our Office in that it helped strengthen our 
international outreach activities in order to better protect the personal information of 
Canadians. 


As a result of the decision, we are conducting an investigation into the complaint about 
Accusearch. 


As well, proceedings have been initiated in the United States against Accusearch with 
respect to its advertising and selling of confidential consumer telephone records to third 
parties without the consent of the individual concerned. Given our Office’s increasing 
interest in international activities in helping to protect the personal information of 
Canadians, our Office is closely monitoring these proceedings. 


Complainant-initiated court applications under section 14 of PIPEDA 
Dr. Jeffrey Wyndowe (Psychiatric Assessment Services Inc.) v. X. 
Federal Court of Appeal File No. A-551-06 


This is a long-running case, which was also discussed in our 2005 and 2006 annual 
reports. At issue is whether an individual has the right to access his personal information 
contained in notes taken by a physician conducting an independent medical examination 
on behalf of an insurance company. 


The Federal Court considered whether such notes contained the “personal information” 
of the individual examined, and if so, whether any exemptions to refusing access to such 
information under PIPEDA applied. The Federal Court held the notes did contain the 
individual’s personal information and that the claimed PIPEDA exemptions did not 
apply. Accordingly, it ordered the doctor to provide access to the notes. 
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The physician appealed. At the Federal Court of Appeal, the issues became, first, 
whether the notes constituted the personal information of the individual examined or 
the work product of the physician; and secondly, whether notes taken in the context 


of an independent medical examination occur in the course of a commercial activity 
covered by PIPEDA. 


The Federal Court of Appeal issued its decision in February 2008 and held that: 


(i) Notes taken by a medical examiner in the course of an independent medical 
examination made at the request of an insurance company are taken in the 
“course of a commercial activity” and thus clearly subject to PIPEDA, and 


(ii) Notes taken by a medical examiner in the course of an independent medical 
examination clearly contain an individual’s personal health information, 
and, therefore, personal information. 


The Federal Court of Appeal held that the individual has a right to access those portions 
of the notes which contain information he provided, and also to correct any mistakes in 
what the medical examiner may have noted about him. 


However, the Court also concluded that information in the notes could be personal 
to both the individual and the physician, and that there may be need for a balancing 
exercise which takes into consideration the private interests of the individual and the 
physician, as well as the public interest in disclosure and non-disclosure. 


‘The case was sent back to the Privacy Commissioner so that she, together with the 
doctor’s counsel, could determine which portions of the notes contain the individual’s 
“personal information” and should be released. 


X. v. Telus Communications Inc. 


Federal Court of Appeal File No. A-639-05 


This case involved Telus employee complaints about 
the company’s implementation of a voice-recognition Note: This case was also reported 


system. in our 2004, 2005 and 2006 


In January 2007, the Federal Court of Appeal confirmed annual reports. 


that: 


(i) The voice-print collected by Telus is personal information; 
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(ii) On the facts, a reasonable person would find the introduction of voice- 
print technology for company authentication and security purposes to be 
reasonable in the circumstances; 


(iii) The Telus voice-print authentication system met PIPED’ consent 
requirement since employees could not be enrolled in the system without 
their active consent; 


(iv) None of the exceptions set out in section 7 of PIPEDA allowing for the 
non-consensual collection apply to these circumstances; and 


(v) Telus properly informed employees of the consequences which might arise 
if they refused consent. 

re cee hw ay fot eee te? er aren 
X. v. Scotia Capital Inc. 
Federal Court File No. T-2181-05 
See ee ee ee eee eee ee 
In response to the complainant’s request for his personal information, Scotia Capital 
provided the complainant with a copy of his personal information but did not include 
his pay stubs or records of hours of work. 


‘The complainant alleged Scotia Capital improperly relied on exemptions for third-party 
information and solicitor-client privileged materials. As a result of our investigation, the 
company forwarded additional information to the complainant. 


‘The Assistant Commissioner concluded the organization was otherwise justified to 
withhold information which consisted of other individuals’ personal information, or was 
subject to solicitor-client privilege. 


The complainant filed an application in the Federal Court under section 14 of PIPEDA. 
The application was later dismissed. 


X. v. J J. Barnicke Ltd. 
Federal Court File No. T-1349-06 


An individual filed a complaint against J.J. Barnicke Ltd. alleging improper collection 
of personal information and inadequate policies to protect personal information. The 
company’s vice-president had sent out a company-wide e-mail asking whether anyone 
knew which firm the complainant worked for. 


The Assistant Privacy Commissioner concluded that, as there was no evidence that 
any J.J. Barnicke employee responded to the e-mail, there was no actual collection of 
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personal information. Therefore, the complaint regarding the improper collection of 
personal information was not well-founded. 


However, the investigation revealed that J.J. Barnicke did not have appropriate privacy 
policies or procedures in place, nor was there a designated privacy officer accountable for 
compliance. Although J.J. Barnicke developed a privacy policy during the course of the 
investigation, the Assistant Privacy Commissioner recommended that the organization 
post the privacy policy on its website, disseminate the privacy policy to its employees 
and provide staff with proper privacy training. J.J. Barnicke fully implemented the 
Assistant Commissioner’s recommendations. 


The complainant filed an application in the Federal Court. A hearing scheduled for 
November 2007 was adjourned on the basis of a preliminary procedural motion and a 
new hearing date had not yet been set. 


Monitoring Function 


As part of our larger court monitoring function, we continued to monitor several court 
cases involving novel privacy issues. This is one of the ways in which we stay abreast of 
possible advancements in the law, whether they be through applications under PIPEDA, 
applications under the Privacy Act, the federal Access to Information Act, or actions in the 
provincial superior courts under the common law or Quebec's civil law. 


For example, we were granted intervener status in X. v. The Minister of Health and 
Privacy Commissioner of Canada, even though this matter originated under the Access to 
Information Act. 


In this case, a journalist sought access to Health Canada’s Canadian Adverse Drug 
Reaction Information System database, which houses mandatory and voluntary reports 
of adverse reactions to drugs marketed in Canada. 


Health Canada refused to reveal the province in which data had been collected on 

the grounds that this information, together with the already released information, 
could permit the identification of individuals when combined with publicly available 
information. The Information Commissioner agreed, holding that the information was 
exempt from access. 


The journalist sought judicial review of Health Canada’s decision. 


Our Office decided to intervene given the significance of this case in relation to the 
interpretation and application of both PIPEDA and the Privacy Act, as well as the 
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interpretation of the meaning of “personal information.” We argued in favour of a broad 
definition of personal information. 


‘This case demonstrates the important role we can play as an intervener on issues having 
a significant impact on PIPEDA and/or the Privacy Act — and in this way contribute 


meaningfully towards the development of privacy jurisprudence in Canada. 


The Federal Court was to hear the case in February 2008. 
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SUBSTANTIALLY SIMILAR PROVINCIAL 
AND TERRITORIAL LEGISLATION 


Section 25(1) of PIPEDA requires our Office to report annually to Parliament on 
the “extent to which the provinces have enacted legislation that is substantially 
similar” to the Act. 


In past annual reports, we have reported on legislation in British Columbia, 
Alberta, Ontario and Quebec which has been declared substantially similar. 


No provinces or territories enacted legislation in 2007 for which they have sought 
consideration as substantially similar to PIPEDA. 
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THE YEAR AHEAD 


Our key priorities for the coming year: 


Continue to improve service delivery 


Design and implement new and innovative investigative strategies to make our 
complaints resolution process more efficient and effective. 


Build a sustainable organizational capacity 


On the human resources side, address retention issues and grow our Office in 
order to balance workload internally and manage increasing demand for our 
Services. 

Continue an information management renewal project; introduce scanning 
technology; use current technologies to update inquiry and investigation 
processes; and modernize our case management system. 


Support Canadians to make informed privacy decisions 


Develop materials to help Canadians better understand their privacy rights and 
take action to protect these rights. 

Prepare and distribute publications and guidelines in print and on the web; 
continue to reach out using new and interactive technologies such as blogs and 
online videos. 

Implement a social marketing campaign on children’s online privacy. 

Put into place education and outreach programs in partnership with provincial 
and territorial privacy commissioners. 


Provide leadership to advance four priority privacy issues 


Information Technology 

o Build sufficient capacity to assess the privacy impact of new information 
technologies. 

o Increase public awareness of technologies with potential privacy impacts. 

o Provide practical guidance to organizations on the implementation of 
specific technologies. 
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e National Security 
o Ensure national security initiatives adequately protect privacy. 
o Ensure proper oversight and accountability of national security agencies’ 
personal information management practices. 
o Raise public awareness of the privacy impacts of national security 
initiatives. 


e Identity Integrity and Protection / Identity Theft 
o Improve organizations’ personal information management practices. 
© Raise public awareness of identity protection. 
o  Persuade the federal government to adopt a coordinated approach to 
identity protection. 


e Genetic Information ; 
o Advance research and knowledge to address new challenges posed by 
genetics in the context of traditional data protection regimes. 
o Raise public awareness about the potential uses of genetic information. 


Advance global privacy protection for Canadians 

¢ Seek legislative amendments to PIPED; co-operate with other data protection 
authorities to ensure privacy protection measures are comprehensive and 
harmonious. 

e Chair an OECD volunteer group reviewing how cooperation between data 
protection authorities and other privacy rights enforcement agencies can be 
enhanced. 

e Continue to work with an APEC data privacy group which has developed a 
privacy framework for APEC member states. 
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DEFINITIONS OF COMPLAINT TYPES UNDER PIPEDA 


Complaints received in the OPC are categorized according to the principles and 
provisions of PIPEDA that are alleged to have been contravened: 


* Access. An individual has been denied access to his or her personal information 
by an organization, or has not received all the personal information, 
either because some documents or information are missing or because the 
organization has applied exemptions to withhold information. 


* Accountability. An organization has failed to exercise responsibility for 
personal information in its possession or custody, or has failed to identify an 
individual responsible for overseeing its compliance with the Act. 


* Accuracy. An organization has failed to ensure that the personal information it 
uses is accurate, complete, and up-to-date. 


* Challenging compliance. An organization has failed to put procedures or 
policies in place that allow an individual to challenge its compliance with the 
Act, or has failed to follow its own procedures and policies. 


¢ Collection. An organization has collected personal information that is not 
necessary, or has collected it by unfair or unlawful means. 


* Consent. An organization has collected, used or disclosed personal information 
without valid consent, or has made the provision of a good or service 
conditional on individuals consenting to an unreasonable collection, use, or 
disclosure. 


¢ Correction/Notation. The organization has failed to correct personal 
information as requested by an individual, or, where it disagrees with the 
requested correction, has not placed a notation on the information indicating 
the substance of the disagreement. 
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¢ Fee. An organization has required more than a minimal fee for providing 
individuals with access to their personal information. 


¢ Retention. Personal information is retained longer than necessary for the 
fulfillment of the purposes that an organization stated when it collected the 
information, or, if it has been used to make a decision about an individual, has 
not been retained long enough to allow the individual access to the information. 


¢ Safeguards. An organization has failed to protect personal information with 
appropriate security safeguards. 


¢ Time limits. An organization has failed to provide an individual with access to 
his or her personal information within the time limits set out in the Act. 


° Use and disclosure. Personal information is used or disclosed for purposes 
other than those for which it was collected, without the consent of the 
individual, and the use or disclosure without consent is not one of the permitted 
exceptions in the Act. 


DEFINITIONS OF FINDINGS AND OTHER DISPOSITIONS 


The Office has developed a series of definitions of findings and dispositions to explain 
the outcome of its investigations under PIPEDA: 


Not well-founded. The investigation uncovered no or insufficient evidence to 
conclude that an organization violated the complainant’s rights under PIPEDA. 


¢  Well-founded. An organization failed to respect a provision of PIPEDA. 


¢ Resolved. The investigation substantiated the allegations but, prior to the 
conclusion of the investigation, the organization took or committed to take 
corrective action to remedy the situation, to the satisfaction of the OPC. 


°  Well-founded and resolved. The Commissioner, being of the view at the 
conclusion of the investigation that the allegations were likely supported by the 
evidence, before making a finding made a recommendation to the organization 
for corrective action to remedy the situation, which the organization took or 
committed to take. 


° Settled during the course of the investigation. The OPC helped negotiate a 


solution that satisfies all involved parties during the course of the investigation. 


No finding is issued. 
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Discontinued. ‘The investigation ended before a full investigation of all the 
allegations. A case may be discontinued for any number of reasons — for 
instance, the complainant may no longer want to pursue the matter or cannot 
be located to provide information critical to making a finding. 


No jurisdiction. The investigation led to a conclusion that PIPEDA did not 
apply to the organization or activity that was the subject of the complaint. 


Early resolution. This applies to situations where the issue was dealt with 
before a formal investigation occurred. For example, if an individual filed a 
complaint about a type of issue that the OPC had already investigated and 
found to comply with PIPEDA, we would explain this to the individual. “Early 
resolution” would also describe the situation where an organization, on learning 
of allegations against it, addressed them immediately to the satisfaction of the 


complainant and the OPC. 
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INVESTIGATION PROCESS UNDER PIPEDA 


Inquiry: 
Individual contacts OPC by letter, by telephone, or in person to complain of violation of Act. Individuals who make contact in person 
or by telephone must subsequently submit their allegations in writing. 


+ 


Initial analysis: 
Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


An individual may complain about any matter specified in sections 5 to 10 of the Act or in Schedule 1 — for example, denial of 
access, or unacceptable delay in providing access, to his or her personal information held by an organization; improper collection, 
use or disclosure of personal information; inaccuracies in personal information used or disclosed by an organization; or inadequate 
safeguards of an organization's holdings of personal information. 


v 
roe Complaint? : La aee 
No: Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


Investigation: 
The investigation provides the factual basis for the Commissioner to determine whether 
the individual's rights have been contravened under P/PEDA. 


Early resolution? 
A complaint may be resolved 
before an investigation is 
undertaken if, for example, the 
issue has already been fully 
dealt with in another complaint 
and the organization has ceased 


The investigator gathers the facts related to the complaint through representations from 
both parties and through independent inquiry, interviews of witnesses, and review of 
documentation. Through the Privacy Commissioner or her delegate, the investigator has 


i] 
i] 

i] 

1 

i] 

i] 

i] 

' The investigator writes to the organization, outlining the substance of the complaint. 
1 

! 

i 

i] 

i] 

i] 

i] 
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the practice. the authority to receive evidence, enter premises where appropriate, and examine or 
rie aaa ahs Sa iat od nea s obtain copies of records found on any premises. 
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Discontinued? Analysis (on next page) 


i) 
i 
: Acomplaint may be discontinued 
: if, for example, a complainant 
decides not to pursue it, ora 


t 
t 
complainant cannot be located. 


Vv 


Note: a broken line (- - - - ) indicates a possible outcome. 
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——__________, 


Analysis: 
The investigator analyses the facts and prepares recommendations to the Privacy Commissioner or her delegate. The investigator 
will contact the parties and review the facts gathered during the course of the investigation. The investigator will also tell the parties 
what he or she will be recommending, based on the facts, to the Privacy Commissioner or her delegate. At this point, the parties may 
make further representations. 


Analysis will include internal consultations with, for example, Legal Services or Research and Policy Sections, as appropriate, 


Findings: 
The Privacy Commissioner or her delegate reviews the file and assesses the report. The Privacy 
Commissioner or her delegate, not the investigator, decides what the appropriate outcome should 
wv j be and whether recommendations to the organization are warranted. 


, Settled? | 1 
| The OPCseeksto | np: ~ 4 
' resolve complaints 1 Preliminary report 
and to prevent | _ Ifthe results of the investigation indicate to the Privacy Commissioner or her delegate that there likely 
' contraventions | — has beena contravention of PIPEDA, she or her delegate recommends to the organization how to remedy 
' from recurring. the matter, and asks the organization to indicate within a set time-period how it will implement the 
' TheCommissioner ' "commendation. 
1 1 ' 
' encourages 1 
1 resolution through 1 ; v 
| mediation, Final Report and Letters of Findings 
' negotiationand | The Privacy Commissioner or her delegate sends letters of findings to the parties. The letters outline the 
! . 4 c « ci we 
' persuasion. The 1 _ basis of the complaint, the relevant findings of fact, the analysis, and the response of the organization to 
; investigator assists ; any recommendations made in the preliminary report. 
Lt : I 
t in this process. ' The possible findings are: 
i} I 
oh cataract aie ag * Not Well-Founded: The evidence, on balance, does not lead the Privacy Commissioner or her delegate to 


conclude that the complainant's rights under the Act have been contravened. 
Well-Founded: The organization failed to respect a provision of the Act. 


Resolved: The investigation substantiates the allegations but, prior to the conclusion of the investigation, 
the organization has taken or has committed to take corrective action to remedy the situation, to the 
satisfaction of our Office. 


Well-founded and resolved: The investigation substantiates the allegations but the organization 
has taken or has committed to take corrective action to remedy the situation, as recommended in the 
Commissioner's preliminary report at the conclusion of the investigation. 


In the letter of findings, the Privacy Commissioner or her delegate informs the complainant of his or her 
rights of recourse to the Federal Court. 


c Wh Seana ie on 5 h Cannes | The complainant or the Privacy Commissioner may choose to apply to the Federal 

; a ne aA Saas opc : Court for a hearing of the matter. The Federal Court has the power to order the 

' g ‘ ee >! organization to correct its practices and to publish a notice of any action taken or 
1 proposed to correct its practices. The Court can award damages to a complainant, 
i 


| staff will follow up to verify that 
, they have been implemented. ' including damages for humiliation. There is no ceiling on the amount of damages. 


Note: a broken line (- - - - ) indicates a possible outcome. 
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APPENDIX 2 — INQUIRY AND INVESTIGATION STATISTICS 


Inquiries Statistics 


Our Inquiries Unit provides one of our most important services to Canadians — quick, 
direct and personalized information about privacy issues. We received almost 8,000 


PIPEDA-related inquiries in 2007. 


Frequently raised issues include: the collection and use of Social Insurance Numbers; 
obtaining access to personal data held by financial institutions; and use and disclosure 
of personal information in the telecommunications and sales sectors. Identity theft is 
another key issue people contact us about. Police often advise individuals who have 
filed police reports about identity theft to get in touch with our Office for further 
information. 


We have recently seen heightened interest by organizations about transborder issues. 


For the period between January 1 and December 31, 2007 


PIPEDA inquiries received by the Inquiries Unit 


Telephone inquiries 6,428 
Written inquiries (letter and fax) 1,208 
Total number of inquiries received 7,636 


PIPEDA inquiries closed by the Inquiries Unit 


Telephone inquiries 6,417 
Written inquiries (letter and fax) 1,142 
Total number of inquiries closed 7,559 
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ANNuat Report To ParLiAMent 2007 — Report on THE PERSONAL INFORMATION Protection AND Etecrronic Documents Act 


| COMPLAINTS RECEIVED BY TYPE RECEIVED BY TYPE | 


By far, the largest number of complaints we receive involve how organizations have used 
and disclosed information. The most common type of use and disclosure complaint 
involves an allegation of personal information being used for purposes other than for 
which it was collected, and being disclosed to third parties without an individual's 
consent. 


Collection complaints usually concern the collection of information without proper 
consent or the collection of more information than required for the stated purpose. 


Access complaints deal mainly with allegations that organizations have not responded to 
requests for personal information or have not provided all of the information to which 


individuals believe they are entitled. 


Complaints received between January 1, 2007 and December 31, 2007 


Complaint type 


Use and Disclosure 120 34 
Collection 68 19 
Access 67 19 
Safeguards 36 10 
Consent 16 5 
Time Limits 13 4. 
Accountability 8 2 
Accuracy 7 Z 
Retention 7 2 
Openness 4 1 
Correction/Notation 3 1 
Fee 1 <1 
Total 350 
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APPENDIX 2 — INQUIRY AND INVESTIGATION STATISTICS 


| BREAKDOWN BY SECTOR | BY SECTOR | 


Complaints received between January 1 and December 31, 2007 


Sector out) eiteertoce | 


Financial Institutions 105 30 
Telecommunications 42 12 
Other 39 11 
Sales 37 11 
Insurance 35 10 
Transportation 28 8 
Professionals 26 Z 
Accommodation 21 6 
Health 9 25 
Services 6 2 
Rental 2 <] 
Total 350 
CATEGORIES 


Financial Institutions: Banks, collection agencies, credit bureaus, credit grantors, 
financial advisors 


Telecommunications: Broadcasters, cable/satellite, telephone, telephone/wireless, 
Internet services 


Other: For example, private schools, aboriginal bands, security companies and private 
investigators. 


Sales: Car dealerships, pharmacies, real estate, retail, stores 

Insurance: Life and health insurance, property and casualty insurance 
Transportation: Air, land, rail, water 

Professionals: Accountants, lawyers 

Accommodation: Hotels, landlords, condominiums, property management 

Health: Chiropractors, dentists, doctors, physiotherapists, psychologists/psychiatrists 
Services: Daycare, hairdressers, beauticians 


Rental: Car rental, other rental 
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Annuat Report 10 ParLiaMeNt 2007 — Report on THE PERSONAL InFoRMATION ProrecTION AND Exectronic Documents Act 


CLOSED COMPLAINTS BY COMPLAINT TYPE 


Complaints closed between January 1, 2007 and December 31, 2007 


Complaint type | 


Use and Disclosure 162 39 
Collection 80 19 
Access 68 16 
Safeguards 3/ 9 
Consent Zo 6 
Time Limits 11 5 
Accountability 9 2 
Retention 9 2 
Correction/Notation 7 2 
Accuracy 5 1 
Openness a 1 
Other (Retaliation)* 2 <1 
Fee 1 <1 
Total 420 


* We closed two retaliation or “whistle-blowing” complaints. The enforcement of 
retaliation complaints is included under section 27.1 of PIPEDA. The provision is aimed 
at ensuring that organizations do not retaliate against employees who have, in good 
faith, brought forward allegations that their employers have contravened PIPEDA or 
will contravene PIPEDA, or that an employee has refused to do something that would 
contravene the legislation. Retaliation could include, for example, dismissal, suspension, 
demotion, or discipline. 


The Commissioner, in her ombudsman role, has an obligation to investigate retaliation 
cases to determine whether she should forward them to the Attorney General of 
Canada for possible prosecution under the Criminal Code. While our Office has 
assessed retaliation complaints, no cases have warranted follow-up with the Attorney 
General. 


Number of complaints in abeyance 
(awaiting assignment to an investigator) on December 31, 2007: 44 
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APPENDIX 2 — INQUIRY AND INVESTIGATION STATISTICS 


| CLOSED COMPLAINTS BY FINDING | COMPLAINTS BY FINDING | 


Almost one third of our closed complaints were settled. This indicates that, in a large 
number of cases, we were successful in finding solutions that satisfied complainants, 
respondents and this Office. 


The next-largest category was discontinued. Cases are discontinued for a number 
of reasons — complainants abandon complaints for personal reasons or because an 
organization resolves an issue before the investigation has begun or our Office can't 
proceed because a complainant hasn't provided us with requested additional details 
necessary to complete an investigation. 


Complaints closed between January 1, 2007 and December 31, 2007 


Finding | Boat arcane 


Settled 125 30 
Discontinued 89 21 
Not well-founded 64 15 
Well-founded Resolved 62 15 
Resolved 4] 10 
Early Resolution 14 5 
No jurisdiction 14 3 
Well-founded 9 2 
Other (Retaliation) 2 <1 
TOTAL 420 
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ANNUAL Report T0 PARLIAMENT 2007 — Report ON THE Personal InFoRMATION ProTEcTION AND ELecrronic Documents Act 


PIPEDA INVESTIGATION TREATMENT TIMES - BY FINDING | 


Roughly one-quarter of our investigations are completed within a year. More complex 
cases take longer to complete. For example, cases involving multi-jurisdictional issues 
or which require extensive research into industry practices usually take more time 

to complete. In some instances, cases take longer if there are delays in obtaining 
information. 


For the period between January 1 and December 31, 2007 


Disposition Average Treatment Time in Months 
Early Resolution 3.36 
Discontinued : 11.18 
No jurisdiction 12.07 
Settled 1217 
Not well-founded 20.56 
Resolved 20.68 
Well-founded Resolved 23.15 
Well-founded 24.36 
Other (Retaliation) 26.00 
Overall Average 15.71 
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APPENDIX 2 — INQUIRY AND INVESTIGATION STATISTICS 


| FINDINGS BY COMPLAINT TYPE | BY COMPLAINT TYPE | 


Complaints closed between January 1, 2007 and December 31, 2007 


~ Well- 
Resolved founded | Resolved | TOTAL 
) 8 46 3 


ae 26 8 ens, 38 162 
Collection 18 2 2 18 0 7 25 2 6 80 
Access Ty 2 s) 4. 0 15 19 1 5 68 
Safeguards 9 1 0 4. 0 > 11 1 8 37 
Consent i. 1 1 2 0 5 7 0 2 25 
Time Limits 4 0 0 0 0 2 3 ; 0 11 
Accountability 0 0 0 2 0 1 5 0 1 9 
Retention Z 0 0 2 0 0 5 0 0 9 
Foes 3 0 0 aes 0a fae pc Ok mee Biabhery, 
Accuracy 2 0 0 1 0 0 1 0 1 5 
Openness 0 0 0 1 0 0 3 0 0 4 
Other 0 0 0 0 Z 0 0 0 0 2 
Fee 1 0 0 0 0 0 0 0 0 1 
TOTAL 89 14 14 64 2 41 125 9 62 420 
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ANNuAL Report 10 ParLiaMeNT 2007 — Report on THE PERSONAL IFORMATION PROTECTION AND Etectronic Documents Act 


| FINDINGS BY INDUSTRY SECTOR | BY INDUSTRY SECTOR | 


Complaints closed between January 1, 2007 and December 31, 2007 


Well- 
0 14 28 


Financial 


Institutions a : 2 - Ease 
ee ir 2 2 12 45 8 
Sales 7. 3 1 2 0 5 34 0 9 61 
Other 17 0 7 8 0 2 23 0 1 58 
Insurance 13 2 0 3 0 6 11 1 8 44 
Transportation a 1 0 11 1 4 Z 2 3 33 
Professionals 3 1 1 0 Z 2 a 14 
Services 2 0 0 0 1 0 0 4 11 
Leder 7 0 0 O00 0) oe ia Ora ro 
Rental 0 0 0 0 0 2 2 0 0 4 
Health 1 0 0 1 0 0 0 0 0 2 
TOTAL 89 14 14 64 2 41 125 9 62 420 
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APPENDIX 2 — INQUIRY AND INVESTIGATION STATISTICS 


| PIPEDA INVESTIGATION TREATMENT TIMES - BY COMPLAINT TYPE 


For the period between January 1 and December 31, 2007 


Complaint Type Average Treatment Time in Months 


Accuracy 9.4* 
Fee 10.0* 
Time Limits Bs) 
Retention FZ 
Access 14.5 
Openness Tae 
Correction/Notation 15.4 
Use and Disclosure 15.8 
Safeguards 15.9 
Accountability 16.2 
Collection 17.0 
Consent 18.0 
Other 26.0* 
Overall average Lowe 


*The treatment time for these complaint types reflects 6 or fewer cases each. 
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